The Agent Skills Directory

[SAFE]: The skill provides a Python implementation for document rendering using the python-docx and openpyxl libraries. The code is well-structured and focuses on its primary task of string replacement and document formatting.
[COMMAND_EXECUTION]: The skill includes Python scripts intended for execution via the agent's environment. The logic is transparent and does not contain any suspicious shell injections or unintended command execution patterns.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill performs local file read and write operations on Word (.docx) and Excel (.xlsx) files. This behavior is strictly within the scope of its defined purpose for document automation and does not involve unauthorized network access.
[PROMPT_INJECTION]: The skill processes external data (Excel spreadsheets and Word templates). While this creates an indirect ingestion surface, the implementation uses simple string replacement for variables and includes regex-based sanitization for output filenames (re.sub(r'[\\/:*?"<>|]', '_', fname)) to prevent directory traversal.
Ingestion points: Data is read from user-provided .xlsx, .csv, or .docx files via openpyxl and python-docx (SKILL.md).
Boundary markers: None used during the interpolation of variables into the Word document.
Capability inventory: The skill can create directories (os.makedirs) and save files (doc.save) in the local environment (SKILL.md).
Sanitization: Filenames derived from user data are sanitized to remove path-traversal and illegal characters.

wps-template-engine