The Agent Skills Directory

[COMMAND_EXECUTION]: Unsanitized shell variable interpolation in Python here-documents. Multiple scripts, including pdf-info.sh, pdf-merge.sh, pdf-split.sh, and pdf-text.sh, are vulnerable. Variables such as $PDF, $OUT, and $PAGES are inserted directly into Python string literals within the script blocks. An attacker providing an input like "; import os; os.system('id'); # would break out of the Python string context and execute arbitrary system commands.
[REMOTE_CODE_EXECUTION]: Risk of exploitation via indirect inputs. Because the agent may be tasked with processing files from untrusted sources (e.g., internet downloads), a file with a maliciously crafted name can trigger the aforementioned command injection vulnerability, leading to unauthorized code execution on the agent's host.
[PROMPT_INJECTION]: Indirect prompt injection surface via PDF metadata. The pdf-info.sh script extracts metadata fields like /Title, /Author, and /Subject and prints them directly to the console. If these fields contain hidden instructions, the agent may interpret the extracted data as a prompt, potentially bypassing its own safety guidelines. There is no evidence of sanitization or escaping of this external content before it is returned to the agent.

pdf-tools