The Agent Skills Directory

[DATA_EXFILTRATION]: The validation scripts in the ooxml/scripts/validation/ directory (including base.py, docx.py, and pptx.py) use lxml.etree.parse() to process XML files extracted from untrusted documents. By default, lxml may resolve external entities, which could be exploited via an XML External Entity (XXE) attack to read sensitive local files if entities are not explicitly disabled.- [PROMPT_INJECTION]: The skill ingests untrusted .docx files and provides their contents to the agent, creating a surface for indirect prompt injection. Malicious instructions within a document could attempt to hijack the agent's behavior. Ingestion points include word/document.xml and conversion via pandoc. No explicit boundary markers or content sanitization are used to separate untrusted data from the agent's instructions. Capability inventory includes shell command execution (pandoc, soffice, pdftoppm) and filesystem write access.- [COMMAND_EXECUTION]: The skill uses subprocess.run to execute various system utilities to perform its primary functions. These include soffice for document conversion and validation, git for diffing changes in redlining workflows, and pdftoppm for document-to-image conversion. While implemented using argument lists rather than shell strings, these tools process untrusted file inputs.- [EXTERNAL_DOWNLOADS]: The SKILL.md instructions recommend installing several external dependencies using system package managers. These include pandoc, libreoffice, and poppler-utils via the system package manager (apt-get), as well as the docx library via npm and the defusedxml library via pip. These are well-known tools and libraries from established registries.

docx