The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill performs dynamic code generation and process injection in scripts/office/soffice.py. It writes C source code to a temporary file, compiles it into a shared object library using gcc, and then uses the LD_PRELOAD environment variable to inject this shim into the soffice process. This is used to redirect network socket calls to facilitate execution in sandboxed environments.
[COMMAND_EXECUTION]: Several scripts, including scripts/accept_changes.py, scripts/office/soffice.py, and scripts/office/validators/redlining.py, utilize the subprocess module to execute system commands. These commands include soffice for document conversion, gcc for the socket shim, git for generating word-level diffs, and pdftoppm for extracting images from documents.
[PROMPT_INJECTION]: The skill processes external .docx files, which presents a surface for indirect prompt injection attacks.
Ingestion points: Untrusted document files are ingested and extracted in scripts/office/unpack.py and scripts/office/validate.py.
Boundary markers: The skill lacks explicit markers or instructions to isolate the content of processed documents from the agent's execution context.
Capability inventory: The skill has the capability to execute system commands via subprocess and perform extensive file-system operations across several scripts.
Sanitization: While defusedxml is employed in scripts/office/validators/base.py and scripts/office/helpers/merge_runs.py to prevent XML-based vulnerabilities like XXE, the skill does not sanitize or filter document text for embedded instructions targeting the AI agent.

docx