The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process content from external Word documents, which can serve as a vector for malicious instructions targeting the AI agent.
Ingestion points: Raw XML content from documents is parsed in scripts/document.py and ooxml/scripts/unpack.py, and content is converted to Markdown via pandoc for agent consumption.
Boundary markers: The instructions lack explicit markers or warnings to the agent to treat document content as untrusted data or to ignore potential instructions embedded within the text.
Capability inventory: The agent has the ability to execute CLI tools like git (in ooxml/scripts/validation/redlining.py) and soffice (in ooxml/scripts/pack.py), and can read/write files across the project workspace.
Sanitization: No explicit sanitization or filtering is performed on text extracted from document XML files before it is processed by the AI.
[COMMAND_EXECUTION]: The skill executes external binaries to perform document validation and version comparison tasks.
Evidence: ooxml/scripts/pack.py uses subprocess.run(["soffice", ...]) to validate document integrity. ooxml/scripts/validation/redlining.py uses subprocess.run(["git", "diff", ...]) to perform character-level comparisons. Both implementations use list-based arguments, which is a secure practice that prevents shell injection.

docx