Home · Documents & Office · pdf
Anthropic's PDF cookbook: working recipes for extraction, merging, splitting, watermarks, encryption, OCR and form filling, plus eight helper scripts.
Score
“On clean PDFs it ties with doing it yourself — the score comes from everything around that: twenty recipes that run as written, a proper form-filling validation loop, and the best file layering we have tested. Two honest caveats: it is proprietary-licensed, and it triggers on any PDF mention.”
Perfect output — and a perfect baseline. On a clean, born-digital PDF the skill added nothing measurable; its value is coverage for the harder files.
Sub-scores & evidence
| Task completion | Both deliverables exact against ground truth: 5/5 line items extracted, totals INV-1042 $1,759.00 and INV-1043 $3,040.00, grand total $4,799.00. | 12/12 |
| Beats the no-skill baseline | The baseline produced byte-identical results on this task. Zero measurable lift on clean digital PDFs — the edge shows up on forms, scans and edge cases instead. | 4/10 |
| Self-verification in output | The skill ships validation tooling for form filling (bounding-box and field checks), but SKILL.md never tells the agent to verify extraction output. | 3/5 |
| Failure behaviour | Recipes degrade gracefully across tools (pypdf / pdfplumber / qpdf / pdftk 'if available'); no failure case was injected this round. | 2/3 |
A cookbook, not a gated procedure — the right shape for file utilities. Every task gets a recipe, a tool pick, and a fallback.
Sub-scores & evidence
| Clear steps | Per-task recipes in working order, routed by a quick-reference table; not a single numbered pipeline, by design. | 5/6 |
| Inputs & outputs defined | Every recipe shows exact inputs, code and output file behaviour. | 4/4 |
| Checks & verification | Form filling has a real validation loop in forms.md plus three check scripts; text/table extraction has none. | 3/4 |
| Stop conditions | Nothing irreversible to gate — recipes write new files instead of overwriting originals. | 3/3 |
| Failure recovery | Most tasks list a second tool path (Python library and CLI), so a missing dependency rarely ends the task. | 3/3 |
The best-layered skill we have tested so far: a 314-line core with 905 lines of reference material that only loads when the task needs it.
Sub-scores & evidence
| Leanness | SKILL.md is 314 lines / 8,072 bytes — about 2,018 tokens in the always-loaded layer. | 5/5 |
| Progressive disclosure | forms.md (294 lines) and reference.md (611 lines) load on demand; the core file routes to each explicitly. | 5/5 |
| Organisation & naming | Quick start, libraries, CLI tools, common tasks, reference table — in the order an agent needs them. | 3/3 |
| No padding | Every section is a working recipe or a decision table; no marketing copy. | 2/2 |
The strongest trigger writing in the official set — explicit 'use whenever' framing and the user's own words. The cost: it fires on any PDF mention, with no off-switch.
Sub-scores & evidence
| What it does | Nine task families named: extract, merge, split, rotate, watermark, create, fill forms, encrypt, OCR. | 4/4 |
| When to use | 'Use this skill whenever the user wants to do anything with PDF files' — an explicit trigger sentence, rare in the wild. | 4/4 |
| User-word keywords | Mirrors how people actually ask: 'If the user mentions a .pdf file or asks to produce one, use this skill.' | 3/3 |
| When NOT to use | No boundary at all. A request to summarise a PDF's contents in chat also pulls in the full processing guide. | 0/3 |
| Naming & voice | Single-word functional name; description written as an instruction to the agent. | 1/1 |
Eight Python scripts, all import-audited: pypdf, pdfplumber, Pillow, pdf2image and the standard library. Nothing reaches for the network, a shell, or your environment.
Sub-scores & evidence
| Least privilege | Scripts operate only on files passed to them. Grep audit found no network calls, subprocess, env access or eval across all eight scripts. | 4/4 |
| Declared tool scope | No allowed-tools field; dependencies are named per recipe (pypdf, pdfplumber, poppler for pdf2image) but unpinned. | 2/3 |
| Sensitive-action confirmation | No destructive or external actions in scope; encryption recipes are standard utilities and outputs are new files. | 3/3 |
Recipes that run as written — we executed two of them verbatim for the A/B test. Includes scar tissue you only get from production use.
Sub-scores & evidence
| Examples & templates | Complete working code for every task family, not fragments. | 3/3 |
| Scripts & instruction precision | Eight shipped scripts matching the forms.md workflow, including validation-image generation for filled forms. | 3/3 |
| Dependencies stated | Libraries named where used, including system poppler for OCR paths — but no pinned requirements file anywhere. | 1/2 |
| Concrete instructions | A best-tool-per-task table, plus warnings like 'never use Unicode subscripts in reportlab — they render as black boxes'. | 2/2 |
Best for / not for
Best for
- Form filling, OCR, encryption, watermarks — the PDF jobs you do twice a year and never remember how
- Agents that process documents unattended, where the validated recipe beats improvisation
- Teams who want one maintained PDF playbook instead of per-project snippets
Not for
- Reading or summarising a PDF in chat — the full processing guide loads anyway
- Projects that need open-source licensing; this one is proprietary Anthropic terms
- Pinned, reproducible environments — dependencies are named, never versioned
What it does
pdf is not advice — it is a cookbook. The core file (314 lines) carries a working recipe for every common PDF job: extract text and tables, merge, split, rotate, watermark, encrypt, create from scratch, OCR a scan. Two layered files sit behind it: forms.md, a complete form-filling workflow with a validation loop, and reference.md, 611 lines of advanced material that loads only when a task reaches for it. Eight Python scripts ship alongside, all for the form workflow — extracting field structure, filling fields, and rendering validation images so the agent can check its own placement.
The writing carries production scar tissue. The reportlab section warns, in capitals, never to use Unicode subscript characters because the built-in fonts render them as solid black boxes — the kind of note that only exists because someone shipped that bug.
How the live test went
We fixed the ground truth before running anything: a generated 3-page PDF with two invoice tables (5 line items), known totals of $1,759.00 and $3,040.00. The baseline agent, with no skill loaded, extracted everything perfectly. The with-skill run, following the SKILL.md recipes literally (pdfplumber for tables, reportlab for the summary), also extracted everything perfectly. Identical CSVs, identical totals.
We publish ties when they happen, because they tell you where a skill’s value is not. For extraction from clean, born-digital PDFs, a modern agent is already competent — no skill changes that. What the recipes buy is the long tail: the form that must be filled and visually validated, the scanned page that needs OCR, the encrypted file, the watermark. Those are the jobs where improvisation fails quietly and a tested recipe with a check step earns its context.
Where it falls short
Three things. First, the licence: unlike most of Anthropic’s skill set (Apache-2.0), this one is proprietary — use is governed by Anthropic’s service terms, which matters if you planned to vendor it into a product. Second, the trigger has no boundary: the description claims any PDF mention, so a request to simply summarise a document also loads the full processing guide. Third, dependencies are named per recipe but never pinned — there is no requirements file, so a fresh environment resolves whatever versions are current that day.
Live A/B test — the evidence
One standard task, run twice: from a 3-page PDF holding two invoices (each with a line-items table) plus a terms page, extract every line item into a single CSV (invoice, item, qty, unit price, amount) and build a one-page summary PDF with per-invoice totals and a grand total. Ground truth fixed in advance: 5 rows; INV-1042 $1,759.00; INV-1043 $3,040.00; grand total $4,799.00.
With the skill
Approach: The skill's own recipes, followed literally: pdfplumber extract_tables() for extraction, reportlab Platypus for the summary PDF
- 5/5 line items extracted, zero errors
- Totals exact: $1,759.00 / $3,040.00 / $4,799.00
- Summary PDF: 1 page, totals verified against ground truth
Without the skill (baseline)
Approach: Agent's own choice of libraries and code, no skill loaded
- 5/5 line items extracted, zero errors
- Totals exact: $1,759.00 / $3,040.00 / $4,799.00
- Summary PDF: 1 page, totals verified against ground truth
| Objective count | With skill | Baseline |
|---|---|---|
| Line items extracted correctly | 5/5 | 5/5 |
| Per-invoice totals correct | 2/2 | 2/2 |
| Grand total | $4,799.00 ✓ | $4,799.00 ✓ |
| Output errors | None | None |
A dead heat — and that is the finding. On a clean, born-digital PDF, a capable agent needs no help. This skill earns its score on the jobs around this one: forms with a validation loop, OCR, encryption, and twenty recipes that run as written.
Full outputs: Source PDF used in the test · With-skill CSV output · Baseline CSV output
Trigger tests
| Prompt | Expected | Result |
|---|---|---|
| “Extract the tables from this PDF into an Excel file” | trigger | Triggers — named verbatim in the description. |
| “Merge these three PDFs and add a watermark” | trigger | Triggers — both operations listed explicitly. |
| “Fill out this PDF form for me” | trigger | Triggers — and routes to forms.md, the layered form-filling workflow. |
| “Read this PDF and tell me what it says” | skip | Borderline — the description claims any PDF mention, so the processing guide loads even for a pure reading task. |
| “Write a Python script to clean this CSV” | skip | Skips — no PDF involved. |
Desk-simulated against the skill's description matching rules; noted as simulated wherever the score depends on it.
Security screen
✓ Pass
Credential theft / exfiltration
✓ Pass
Remote code download & execute
✓ Pass
Data sent to unrelated third parties
✓ Pass
Hidden instructions (incl. invisible Unicode)
✓ Pass
Obfuscated payloads
✓ Pass
Privilege escalation requests
Screening only — not a security certification. We audited all eight shipped scripts (imports and a pattern scan for network, shell and credential access). Industry context: Snyk's ToxicSkills scan of 3,984 public skills found security flaws in 36.82% of them.
Install
Claude Code (plugin)
/plugin marketplace add anthropics/skills /plugin install document-skills@anthropic-agent-skills
Any agent (skills CLI)
npx skills add anthropics/skills --skill pdf
Cursor / Codex (manual)
# copy the pdf folder into: .cursor/skills/pdf/ # Cursor project .agents/skills/pdf/ # shared agents folder # then: pip install pypdf pdfplumber reportlab
Alternatives
xlsx / pptx / docx (Anthropic)
The sibling document skills from the same repository, same cookbook pattern and same proprietary licence. If your work is spreadsheets rather than PDFs, start there — we are testing them next.
Frequently asked questions
Is the pdf skill safe?
In our screening on 2026-10-22, pdf passed all six security red lines (credential theft, remote code execution, data exfiltration, hidden instructions, obfuscated payloads, privilege abuse) and scored 9/10 on the safety dimension. Screening is not a certification — re-screen after major updates.
What is the pdf skill used for?
Anthropic's PDF cookbook: working recipes for extraction, merging, splitting, watermarks, encryption, OCR and form filling, plus eight helper scripts.
How do I install the pdf skill?
For Claude Code, add the marketplace and install the plugin set that contains it. With the skills CLI: npx skills add anthropics/skills --skill pdf. For Cursor or Codex, copy the pdf folder into .cursor/skills/ or .agents/skills/. Full commands are in the Install section of this page.
How good is the pdf skill?
pdf scored 84/100 (grade A) in our live test on 2026-10-22: On clean PDFs it ties with doing it yourself — the score comes from everything around that: twenty recipes that run as written, a proper form-filling validation loop, and the best file layering we have tested. Two honest caveats: it is proprietary-licensed, and it triggers on any PDF mention.
Tested 2026-10-22 in an agent environment following the skill's own instructions — not inside the Cursor desktop app. Scores follow the Skills List methodology v1: red lines veto regardless of score; install counts and stars never count toward quality. More in Documents & Office.