The Agent Skills Directory

[DATA_EXFILTRATION]: The document unpacking logic in ooxml/scripts/unpack.py and the validation modules in ooxml/scripts/validation/ use zipfile.extractall() without validating paths within the archive. This vulnerability (Zip Slip) allows a maliciously crafted .pptx file to overwrite arbitrary files on the filesystem. Furthermore, while some parts of the skill use defusedxml, others rely on lxml.etree.parse() without explicit XXE protections, creating a risk when processing untrusted XML data.
[COMMAND_EXECUTION]: Scripts including scripts/thumbnail.py and ooxml/scripts/pack.py execute system commands like soffice and pdftoppm using subprocess.run(). These calls pass user-supplied file paths as arguments without using the -- delimiter to mark the end of options, making them susceptible to argument injection if a filename starts with a hyphen.
[INDIRECT_PROMPT_INJECTION]: The skill extracts and processes text from user-provided PowerPoint files through markitdown and custom inventory scripts. Ingestion points: Extracted content is written to template-content.md and text-inventory.json for agent processing. Boundary markers: instructions lack delimiters or warnings to ignore data-embedded instructions. Capability inventory: the skill can execute subprocesses, write to the filesystem, and utilize Playwright for rendering. Sanitization: no filtering or validation of extracted presentation content is performed before it enters the agent context.

pptx