The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The processing of external document content represents an inherent attack surface for indirect prompt injection.
Ingestion points: Content is ingested from external Word files via ooxml/scripts/unpack.py and pandoc conversion.
Boundary markers: The instructions do not specify a system for delimiting document text from instructions to prevent accidental obedience.
Capability inventory: The skill has access to file writing and command execution through subprocess.run.
Sanitization: While the skill uses defusedxml to secure the XML structure, it does not sanitize the natural language content extracted from documents.
[COMMAND_EXECUTION]: The skill uses subprocess.run to execute well-known system utilities.
Evidence: ooxml/scripts/pack.py invokes soffice for conversion and validation, and ooxml/scripts/validation/redlining.py invokes git for diffing. These operations use list-based argument passing which mitigates command injection risks.
[EXTERNAL_DOWNLOADS]: Instructions guide the installation of dependencies from well-known and trusted package registries.
Evidence: SKILL.md documents the installation of pandoc, libreoffice, and poppler-utils via apt, the docx library via npm, and defusedxml via pip.

docx