The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes system commands such as soffice (from LibreOffice) and git to perform document conversions and compare text changes. These operations are performed using the subprocess.run method with argument lists rather than shell strings, which effectively prevents command injection vulnerabilities.
Evidence: Implementation found in ooxml/scripts/pack.py and ooxml/scripts/validation/redlining.py.
[DYNAMIC_EXECUTION]: The skill's primary workflow involves the AI agent generating and executing Python or JavaScript scripts to interact with the provided document libraries. This capability is intentional and follows the technical guidelines provided within the skill's documentation to ensure correct and safe document manipulation.
Evidence: Workflow instructions in SKILL.md and technical tutorials in ooxml.md and docx-js.md.
[SAFE]: The skill consistently utilizes the defusedxml library for all XML parsing and manipulation tasks. This proactively protects the environment from XML External Entity (XXE) attacks and other common XML-related security risks when processing untrusted document files.
Evidence: Secure parsing implementations in scripts/document.py, scripts/utilities.py, and ooxml/scripts/pack.py.

docx