The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill processes untrusted PDF files to extract text and metadata.
Ingestion points: scripts/extract_form_field_info.py and scripts/fill_fillable_fields.py via pypdf.
Boundary markers: Absent in forms.md instructions.
Capability inventory: File-write operations in scripts/fill_fillable_fields.py and scripts/fill_pdf_form_with_annotations.py; subprocess execution suggested in SKILL.md for tools like qpdf and pdftk.
Sanitization: Absent. This creates a surface where malicious instructions embedded in a PDF could influence the agent's behavior during analysis.
[Dynamic Execution] (MEDIUM): scripts/fill_fillable_fields.py implements runtime monkeypatching of the pypdf library to modify internal behavior.
[Command Execution] (LOW): Documentation encourages use of system-level CLI tools for PDF operations.
[External Downloads] (LOW): Depends on multiple external Python packages. Trusted source status (Anthropic) for the skill itself applies to the distribution, but the dependency chain remains an observation.

pdf