The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run in ooxml/scripts/pack.py and ooxml/scripts/validation/redlining.py to invoke soffice (LibreOffice) for document validation and git for calculating text differences. These operations are essential for the primary functionality of document processing and are implemented safely by passing arguments as lists without shell invocation.
[INDIRECT_PROMPT_INJECTION]: As a tool that ingests and extracts content from .docx files, the skill has a surface for indirect prompt injection from data within processed documents. The skill mitigates standard XML-based attack vectors (such as XXE) by consistently using the defusedxml library for all XML parsing operations in scripts/document.py, scripts/utilities.py, and the validation scripts.
[EXTERNAL_DOWNLOADS]: The documentation in SKILL.md provides standard setup instructions for well-known software including pandoc, docx (npm), and LibreOffice. The skill's runtime code does not perform any automated or hidden downloads from remote servers.

docx