The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted PowerPoint files and extracts natural language content, creating an indirect prompt injection surface.\n
Ingestion points: XML content extraction in ooxml/scripts/unpack.py and structured text inventory generation in scripts/inventory.py.\n
Boundary markers: No explicit delimiters are present to isolate extracted text from agent instructions.\n
Capability inventory: File system access, script generation, and external command execution (soffice, git, pdftoppm) as seen in scripts/thumbnail.py and ooxml/scripts/pack.py.\n
Sanitization: Uses defusedxml to prevent XML External Entity (XXE) attacks, but does not sanitize extracted text for malicious instructions.\n
Self-referential content: The skill includes a skill-report.json file with an embedded security audit claiming a "SAFE" status, which is a pattern sometimes used to bypass automated scrutiny.\n- [COMMAND_EXECUTION]: The skill executes external CLI tools via subprocess.run to handle document conversion and comparison tasks.\n
Evidence: scripts/thumbnail.py and ooxml/scripts/pack.py invoke soffice (LibreOffice) for PDF conversion and document validation.\n
Evidence: scripts/thumbnail.py invokes pdftoppm (Poppler) for slide image rendering.\n
Evidence: ooxml/scripts/validation/redlining.py executes git diff.\n
These calls use argument lists instead of shell strings, which effectively mitigates command injection, although they provide access to powerful system binaries.

pptx-official