Apache Tika is a toolkit that reads many kinds of files and extracts their text and descriptive metadata, including from formats such as PDF, PowerPoint, and Excel. Applications and agent pipelines use it to turn documents into content they can process, search, or pass to language models. The catalogue skills provide reusable ways for coding agents to run Tika for file-to-Markdown extraction.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add apache/tika --skill file-forensicsgit clone --depth 1 https://github.com/apache/tikaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/apache/tika/file-forensics)<a href="https://agentmods.dev/skills/apache/tika/file-forensics"><img src="https://agentmods.dev/badge/skills/apache/tika/file-forensics/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/apache/tika/file-forensics"><img src="https://agentmods.dev/badge/skills/apache/tika/file-forensics.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 5 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 79 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
- medium Data Exfiltration · line 82 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Excessive Agency · line 227 Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.Fix: Restrict tool access to only the tools required for the skill's stated purpose. Use an explicit allowlist rather than granting blanket access.
- medium Data Exfiltration · line 355 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- low Privilege Escalation · line 227 Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.Fix: Request only the minimum permissions required. Document why each permission is needed. Remove broad permissions like '*' or 'all'.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00142 | $0.05982 |
| Opus 5.5 | $0.00057 | $0.02393 |
| Sonnet 5.5 | $0.00028 | $0.01196 |
| Haiku 4.5 | $0.00014 | $0.00598 |
Grade B, and why
file-forensics scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Unrestricted tool accessmediumExcessive agency
A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.
under `access-permission:*` — the restriction flags are themselves Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -T suspect.file http://localhost:9998/rmeta > suspect.rmeta.json How it starts
The opening of the file, as written. The whole thing — 462 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Local override: $TIKA_SKILLS_LOCAL/file-forensics/LOCAL.md (default ~/.tika-skills),
read after this file, wins on conflict.
File forensics with Apache Tika
What this can and cannot tell you. Tika cannot tell you who wrote a
file. It can tell you — exhaustively — what the file claims about itself
and what it actually contains, and those claims are the evidence: a
dc:creator value is an assertion some software recorded, not an identity;
a template-default author, an inconsistency between claimed dates, or a
conspicuously missing field is as much a finding as a present one. Report
what the file says; let the human draw conclusions.
The one rule for reading Tika's output: the key prefix tells you who is asserting each fact.
tk:*— Tika's own parse-time observations, which the file cannot forge into place: magic-byte-detected type, embedded-item structure, encryption status, digests of the actual bytes.- Everything else (
dc:,pdf:docinfo:,extended-properties:,xmp:, ...) — the file's claims about itself, recorded by whatever software touched it, editable by anyone with a hex editor.
Disagreement between the two classes is where findings live.
And one rule with no exceptions: no date in a file is an observation. Creation, modification, and print timestamps — including the per-revision timestamps inside PDF incremental updates — are written by software under the control of whoever produced the file, and can be set to anything. Tika can observe that a revision layer exists, how large it is, and what it contains; when it was written is only ever claimed. Report timestamps as "the file records...", never "this happened at...".
Setup (getting tika-app or a tika-server) is covered by the
file-to-markdown companion skill; this skill assumes one is available and
uses the same invocation shapes. Parse suspect files in isolation — this
is not optional for forensics work. tika-server and tika-app -f both
parse in crash-isolated forked processes; for hostile-file triage prefer the
Docker route with the input mounted read-only (see file-to-markdown-docker)
so the parse can neither modify the evidence nor touch anything else.
The one-command forensics rig — the stock Tika image started with this skill's config (which IS the unlock on the server surface: none of these switches are on by default there):
docker run -d --rm --name tika-forensics -p 127.0.0.1:9998:9998 \
-v "$(pwd)/file-forensics-config.json:/file-forensics-config.json:ro" \
apache/tika:latest-full -c /file-forensics-config.json
curl -T suspect.file http://localhost:9998/rmeta > suspect.rmeta.json
docker stop tika-forensics # when done
Guaranteed OCR, read-only config, process isolation, explicit named configuration — in one command.
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago Changed · +4 lines b1babaeeb4ca
- 1mo ago First seen · 458 lines · 142 tokens per session scan B be16e68b3d36
file-forensics is a skill published in the GitHub repository apache/tika (4,099 stars, last pushed today), licensed Apache-2.0. It adds 142 tokens to every session and 5,982 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it B with 2 findings (unrestricted tool access, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
audio-transcriber
Transform audio recordings into professional Markdown documentation with intelligent summaries using LLM integration.
java-affected-tests
Use before opening or updating an OpenMetadata PR that changes Java, a JSON schema, an index mapping, a SQL migration, seed data or a pom — PR CI no longer runs the Java integration tests (they run only in the merge queue) and the JavaUIIT/search-it suites run only nightly, so this selects the unit tests and…
java-checkstyle
Run mvn spotless:apply to fix Java checkstyle / formatting failures and verify the result. Invoke after authoring or modifying any .java files, or when CI reports a "Java checkstyle failed" or "Fix Java checkstyle" issue on a PR.
pdf-processing
Extract text from PDFs, fill forms, and merge documents.
azure-ai-formrecognizer-java
Build document analysis applications with Azure Document Intelligence (Form Recognizer) SDK for Java. Use when extracting text, tables, key-value pairs from documents, receipts, invoices, or buildi...
document-processing
Use when the deliverable is a document's bytes or its literal content — text/tables out of PDFs, AcroForm fill and flatten, page merge/split, PDF/DOCX from templates, OCR of image-only scans. NOT schema-typed fields pulled from text (that is structured-extraction), NOT signature routing (e-signature) or spreadsheet…