Agent Skill · Anthropic
PDF skill
Anthropic's published skill for working with PDF files — extracting content, filling forms and generating documents via bundled scripts.
This skill bundles executable code. Scripts shipped alongside the instructions run with the permissions of the engineer running the agent. Review the scripts, not only the SKILL.md.
What it is, and what it costs you
The PDF skill is the clearest illustration of why Agent Skills exist as a format rather than as more prompt text. Reliable PDF manipulation is not a reasoning problem — it is a library problem, with well-defined operations that a script performs deterministically and a language model performs approximately. The skill therefore pairs instructions about *when and how* to handle PDFs with code that does the actual work.
That design is what makes it effective and what makes it a review target. A skill that bundles scripts is not a document; it is a small software package that arrives through a channel with no dependency review, no lockfile, and no software-composition-analysis coverage. The engineer installing it sees a folder of Markdown and reasonably concludes there is nothing to review.
The second consideration is the input. PDFs are a notoriously rich container format, and a PDF handed to an agent is untrusted input twice over: its text can carry instructions aimed at the model, and its structure exercises parsing code that has a long history of vulnerabilities. Invisible text, form field metadata, and annotations all survive extraction while being invisible to a human who opens the file to check it.
For most teams the useful posture is not avoidance — this skill solves a real problem well — but placement. Run document-processing skills where the blast radius of a malicious input is a disposable environment, not an engineer's laptop with their credentials on it.
Capability profile
What this skill can reach inside your environment, and why a security team cares. Derived from the publisher's documentation, not from a scan.
- bundled script execution
Code runs with the permissions of the user running the agent. This is the primary review consideration for any script-bundling skill.
- file read and write
Reads input documents and writes generated output to the local filesystem.
- untrusted document ingestion
Extracted PDF text — including text invisible to a human reader — enters the context window as apparent instruction.
Before you distribute this to a team
- Review the bundled scripts, not just the SKILL.md
The Markdown is the part people read. The scripts are the part that executes. Read both before distributing to a team.
- Pin the version you reviewed
Track an exact commit or release rather than a moving branch, so the reviewed artifact is the installed artifact.
- Process untrusted documents in a sandbox
A disposable environment with no credentials and restricted egress turns a malicious PDF into a non-event.
Vincosha Assay assessment
not yet assessedWe have not published a scan verdict for PDF skill.
Everything above is a capability profile compiled by hand from the publisher's own public documentation on 2026-07-25. It describes what this artifact can reach and what to restrict before rolling it out. It is not a security verdict, and it should not be read as one.
When Vincosha Assaypublishes an assessment for this artifact it will appear here with a verdict, the findings behind it, and the date it ran. We would rather leave this space empty than fill it with a guess — inventing a security verdict about somebody else's software would be both wrong and dangerous.
What an assessment covers
- prompt-injection patterns in descriptions and instructions
- credential reads and outbound egress in bundled code
- over-scoped permissions and manifest claims
- typosquatted and impersonating names
- tool-manifest drift since the last approval
- content hash against the version you approved
Sources
Compiled from the publisher's own documentation and repository. Skills change — read the version you are about to install rather than trusting a profile.