The Agent Skills Directory

[DYNAMIC_EXECUTION]: scripts/office/soffice.py implements a sophisticated runtime compilation and process injection workflow. It writes hardcoded C source code to the system's temporary directory and compiles it into a shared object (.so) library using the system's gcc compiler. This dynamically created library is then injected into the LibreOffice (soffice) process using the LD_PRELOAD environment variable.
[PRIVILEGE_ESCALATION]: The process injection technique involving LD_PRELOAD in scripts/office/soffice.py allows the skill to modify the system-level behavior and execution flow of other binaries (LibreOffice), posing a significant escalation risk even within sandboxed environments.
[COMMAND_EXECUTION]: Multiple components execute system binaries using subprocess.run with path-based arguments. Notable examples include the execution of gcc for compilation in soffice.py, git for diffing in redlining.py, and the headless execution of soffice in accept_changes.py.
[INDIRECT_PROMPT_INJECTION]: The skill processes complex, external document data, creating a large surface for indirect prompt injection attacks.
Ingestion points: Untrusted document XML content is ingested and parsed in scripts/office/validators/docx.py and scripts/office/validators/redlining.py.
Boundary markers: The skill fails to use explicit delimiters or "ignore embedded instructions" warnings when processing document components.
Capability inventory: The skill maintains high-privilege capabilities including runtime compilation, library injection, shell command execution, and file system modification.
Sanitization: While defusedxml is used in several helpers to mitigate XXE, scripts/office/validators/redlining.py uses the standard xml.etree.ElementTree and scripts/office/validators/base.py uses lxml.etree without explicit entity resolution restrictions, creating potential vulnerabilities to XML-based attacks from malicious documents.

word-read-write