The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to use sudo for installing system dependencies like pandoc, libreoffice, and poppler-utils. This encourages privilege escalation during the setup phase.
[COMMAND_EXECUTION]: The workflow requires the agent to generate and execute custom Python and JavaScript/TypeScript scripts for XML manipulation and document generation. It also involves running system utilities such as pandoc, soffice, and pdftoppm to process external files.
[PROMPT_INJECTION]: The skill contains behavioral overrides, specifically mandating that the agent 'NEVER' set range limits when reading reference documentation files (docx-js.md, ooxml.md). This attempts to bypass standard agent tool constraints for context management and file reading.
[PROMPT_INJECTION]: The skill is subject to indirect prompt injection risks as it is designed to ingest and process untrusted .docx files from external sources.
Ingestion points: Document files are read via pandoc for markdown conversion or unpacked into XML for direct editing (SKILL.md, ooxml.md).
Boundary markers: The instructions do not include the use of delimiters or specific warnings to ignore instructions that might be embedded within the document content.
Capability inventory: Across its scripts and documentation, the agent is granted capabilities for shell command execution, file system modification, and the ability to write and run scripts (SKILL.md, docx-js.md, ooxml.md).
Sanitization: While the skill recommends using defusedxml for secure XML parsing to prevent XXE attacks, there is no mention of sanitizing or filtering the actual textual content extracted from the documents.

docx