office-docx
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes benign shell commands (
mkdir,cp) and runs its validation script throughuv run. These actions are confined to the local environment and the skill's own file structure. - [EXTERNAL_DOWNLOADS]: The skill depends on the
python-docxpackage from PyPI, managed byuv. This is a trusted, well-known library for document processing. - [SAFE]: The skill includes functionality to read existing documents, which constitutes an indirect prompt injection surface. Ingestion point:
Document(path)call inSKILL.md. Boundary markers: Absent. Capability inventory: Local file writing and script execution viauv, with no network access or high-privilege operations. Sanitization: Absent. Given the skill's primary purpose and lack of dangerous capabilities, this surface presents minimal risk.
Audit Metadata