The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/setup.sh and scripts/setup.ps1 files facilitate the download of official development tools. Specifically, they fetch the .NET installation script from Microsoft's dot.net domain.
[REMOTE_CODE_EXECUTION]: The setup scripts automate the installation of the .NET SDK by downloading and executing the installer from a well-known service provider. This is a standard procedure for bootstrapping a development environment on various platforms.
[COMMAND_EXECUTION]: The skill performs legitimate system configuration tasks, such as using sudo to install packages via apt on Linux and appending the .NET binary path to the user's shell profile (.bashrc) to ensure the SDK is available across sessions.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The C# CLI tool and logic in scripts/dotnet/ process input DOCX files which may contain untrusted data.
Boundary markers: Not explicitly present for the document text content, but the skill relies on the structured OpenXML SDK for parsing.
Capability inventory: The skill can read and write files and is executed via the dotnet runner.
Sanitization: The code demonstrates awareness of XML safety by explicitly escaping special characters when filling placeholders and using a strongly-typed SDK to interact with the document structure.
[SAFE]: Extensive review of the 74 files, including instructional markdown, C# source code, and shell scripts, revealed no signs of obfuscation, data exfiltration, or credential theft. The skill's behavior is consistent with its stated purpose of professional document processing.

docx-toolkit