The Agent Skills Directory

[DYNAMIC_EXECUTION]: Script 'scripts/office/soffice.py' contains hardcoded C source code for a socket shim that is written to a temporary file and compiled at runtime using 'gcc -shared -fPIC'. The resulting library is injected into the LibreOffice process via 'LD_PRELOAD' to bypass 'AF_UNIX' socket restrictions. While intended for compatibility, this pattern involves on-the-fly code generation and process injection.
[COMMAND_EXECUTION]: The skill uses 'subprocess.run()' to invoke several external binaries: 'gcc' for shim compilation, 'soffice' for document processing, 'pdftoppm' for image conversion, and 'git' for version comparison. These tools are used for legitimate functionality but expand the overall security boundary of the skill.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied '.pptx' files by unzipping them and extracting content from XML components. This ingestion of external data, combined with the skill's capabilities to execute system commands and modify files, represents a surface for indirect injection. Evidence chain: 1. Ingestion in 'scripts/office/unpack.py'; 2. Boundary markers are absent; 3. Capabilities include file manipulation and command execution; 4. Sanitization is limited to 'defusedxml' usage.

pptx