The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill converts external documents into text or Markdown for the agent to process, creating a surface where document content could influence agent behavior. \n
Ingestion points: Document content is read into the context after conversion by pandoc or being unpacked into XML via ooxml/scripts/unpack.py. \n
Boundary markers: Instructions do not mandate the use of delimiters or 'ignore embedded instructions' warnings when the agent reads document text. \n
Capability inventory: The skill allows the agent to execute subprocesses (soffice, git) and perform file system write operations. \n
Sanitization: There is no explicit sanitization of document content before it is presented to the agent. \n- [COMMAND_EXECUTION]: The skill relies on external utilities and performs archive manipulations that carry security risks. \n
Subprocess execution: Scripts like ooxml/scripts/pack.py and ooxml/scripts/validation/redlining.py execute soffice and git. While they use list-based arguments which mitigate shell injection, they are triggered by potentially untrusted document states. \n
Archive extraction risk: ooxml/scripts/unpack.py and ooxml/scripts/validation/redlining.py use zipfile.extractall() to extract content from .docx files. This operation is vulnerable to path traversal (ZipSlip) if a malicious document contains filenames with relative paths (e.g., ../../target), potentially allowing files to be written outside the intended workspace.

docx