The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill inherently processes untrusted .docx files and their XML contents, which could contain embedded instructions. Evidence Chain: Ingestion occurs in ooxml/scripts/unpack.py and scripts/document.py. Boundary markers for external content are not explicitly defined in the skill prompts. Capability inventory: Subprocess calls (soffice, git) and file system access (zipfile, shutil) exist in ooxml/scripts/pack.py and ooxml/scripts/validation/redlining.py. Sanitization: Employs defusedxml to prevent XML-based attacks and html.escape for metadata interpolation. \n- [COMMAND_EXECUTION]: The skill invokes local system tools soffice and git for document validation and redlining diffs. Evidence: Found in ooxml/scripts/pack.py and ooxml/scripts/validation/redlining.py. Context: These calls use lists of arguments to avoid shell interpolation and are restricted to local paths within the agent's workspace or temporary directories.

docx