Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/tale-project/tale/pdfnpx skills add tale-project/tale --skill pdfgit clone --depth 1 https://github.com/tale-project/taleWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00092 | $0.02121 |
| Opus 5 | $0.00046 | $0.01060 |
| Sonnet 5 | $0.00018 | $0.00424 |
| Haiku 4.5 | $0.00009 | $0.00212 |
Grade A, and why
pdf scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
83% identical to pdf — 54 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 334 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PDF Processing Guide
Overview
This guide covers essential PDF processing operations using Python libraries and command-line tools. For advanced features, JavaScript libraries, and detailed examples, see REFERENCE.md. If you need to fill out a PDF form, read FORMS.md and follow its instructions.
Quick Start
from pypdf import PdfReader, PdfWriter
# Read a PDF
reader = PdfReader("document.pdf")
print(f"Pages: {len(reader.pages)}")
# Extract text
text = ""
for page in reader.pages:
text += page.extract_text()
Python Libraries
pypdf - Basic Operations
Merge PDFs
from pypdf import PdfWriter, PdfReader
writer = PdfWriter()
for pdf_file in ["doc1.pdf", "doc2.pdf", "doc3.pdf"]:
reader = PdfReader(pdf_file)
for page in reader.pages:
writer.add_page(page)
with open("merged.pdf", "wb") as output:
writer.write(output)
Split PDF
reader = PdfReader("input.pdf")
for i, page in enumerate(reader.pages):
writer = PdfWriter()
writer.add_page(page)
with open(f"page_{i+1}.pdf", "wb") as output:
writer.write(output)
Extract Metadata
reader = PdfReader("document.pdf")
meta = reader.metadata
print(f"Title: {meta.title}")
print(f"Author: {meta.author}")
print(f"Subject: {meta.subject}")
print(f"Creator: {meta.creator}")
Rotate Pages
reader = PdfReader("input.pdf")
writer = PdfWriter()
page = reader.pages[0]
page.rotate(90) # Rotate 90 degrees clockwise
writer.add_page(page)
with open("rotated.pdf", "wb") as output:
writer.write(output)
pdfplumber - Text and Table Extraction
Extract Text with Layout
import pdfplumber
with pdfplumber.open("document.pdf") as pdf:
for page in pdf.pages:
text = page.extract_text()
print(text)
Extract Tables
with pdfplumber.open("document.pdf") as pdf:
for i, page in enumerate(pdf.pages):
tables = page.extract_tables()
for j, table in enumerate(tables):
print(f"Table {j+1} on page {i+1}:")
for row in table:
print(row)
What ships with it
11 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- forms.md 12 KB
- LICENSE.txt 1.4 KB
- reference.md 16 KB
- scripts/check_bounding_boxes.py 3.0 KB runs code
- scripts/check_fillable_fields.py 278 B runs code
- scripts/convert_pdf_to_images.py 1002 B runs code
- scripts/create_validation_image.py 1.3 KB runs code
- scripts/extract_form_field_info.py 4.4 KB runs code
- scripts/extract_form_structure.py 4.3 KB runs code
- scripts/fill_fillable_fields.py 3.8 KB runs code
- scripts/fill_pdf_form_with_annotations.py 3.2 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 334 lines · 92 tokens per session scan A 31565eaba291
pdf is a skill published in the GitHub repository tale-project/tale (23 stars, last pushed 2d ago), licensed MIT. It adds 92 tokens to every session and 2,121 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. It is 83% identical to pdf, differing in 54 lines, and is treated as a copy.
Other skills, from other repositories
audit-event
Use when adding or changing an audit event, the audit log schema, SIEM export, or anything writing to auditevents. Also use when adding a code path that grants or denies access, since denials are events. Triggers on "audit", "audit log", "auditevents", "SIEM", "journal", "access log", "who read what".
db-migration
Use when changing the PostgreSQL schema, adding a migration under packages/core/migrations, or touching row-level security, the grants table, tombstones, or the audit table. Triggers on "migration", "schema", "DDL", "RLS", "row level security", "ALTER TABLE", "new column", "index" in a database context.
mcp-tool
Use when adding or changing an MCP tool, the MCP transport, or MCP authorization in packages/mcp — tool schemas, tools/list, the Streamable HTTP endpoint, STDIO mode, OAuth, CIMD, EMA, or ID-JAG. Triggers on "MCP tool", "tools/list", "Streamable HTTP", "Mcp-Method", "CIMD", "DCR", "EMA", "ID-JAG", "resource server"…
open-core-boundary
Use when deciding whether a feature belongs in this open-source repository or in the private nacre-enterprise one, when adding an extension point, or when a change touches multi-tenancy, SSO, SCIM, document-level deny rules, EMA/ID-JAG, the audit log, the global admin, or quotas. Triggers on "enterprise"…
authz-change
Use when changing anything under packages/core/authz, the grants table, the effective-principals cache, or the vector pre-filter — the permission resolver, deny handling, scope inheritance, ACL tags, or the T1-T25 suite. Also use when a change elsewhere could affect who can see what, such as touching search filters…
config-var
Use when adding, renaming, or removing an environment variable, changing startup configuration validation, adding a Compose profile or service, or adding a Prometheus metric. Triggers on "environment variable", "NACRE", "config", "docker compose", "profile", "metrics", "healthcheck", "readiness".