The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to execute external utilities including soffice, pdftoppm, and git. While arguments are passed as a list, these tools are invoked on untrusted PowerPoint files, which may contain exploits targeting the underlying processing libraries of those tools.
[COMMAND_EXECUTION]: A directory traversal vulnerability (Zip Slip) exists in ooxml/scripts/unpack.py and ooxml/scripts/validation/redlining.py. These scripts use zipfile.ZipFile.extractall() without validating that the extracted file paths remain within the intended target directory, potentially allowing a malicious PowerPoint file to overwrite sensitive files or configuration outside the workspace.
[DATA_EXFILTRATION]: The scripts/html2pptx.js script is vulnerable to local file inclusion. It uses Playwright (chromium.launch) to load files based on paths provided to the html2pptx function. The lack of path validation allows for the exposure of sensitive local data if the agent is directed to process non-HTML files in the browser instance.
[PROMPT_INJECTION]: The skill has a high attack surface for indirect prompt injection (Category 8). It ingests untrusted text content from PowerPoint presentations and uses it to drive complex multi-step workflows involving file system writes and browser execution.
Ingestion points: PowerPoint text is extracted via scripts/inventory.py and markitdown.
Boundary markers: None. The agent is instructed to read the full content of extraction outputs without delimiters or warnings to ignore embedded instructions.
Capability inventory: Broad capabilities including file manipulation, browser execution via Playwright, and shell command execution via subprocess.run across multiple scripts.
Sanitization: While defusedxml is used for XML parsing, there is no filtering or sanitization of the extracted document text content before it enters the agent's reasoning context.

pptx