The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions to override the agent's internal operational constraints. It repeatedly mandates that the agent 'NEVER set any range limits' when reading reference files (docx-js.md and ooxml.md). This directive forces the agent to ignore standard safety or resource management configurations regarding context window usage and file access.\n- [COMMAND_EXECUTION]: The skill requires the use of sudo to install system-level dependencies such as pandoc, libreoffice, and poppler-utils. Instructing an agent to use elevated privileges is a high-risk practice that can lead to unauthorized system modifications.\n- [COMMAND_EXECUTION]: The skill's primary workflows rely on the execution of multiple shell commands, including pandoc, soffice (LibreOffice), and pdftoppm. These tools are used to convert and process user-provided documents, providing a wide surface for potential command injection if filenames or contents are not strictly validated.\n- [EXTERNAL_DOWNLOADS]: The instructions direct the agent to download and install packages from public registries, including NPM (docx) and PyPI (defusedxml), as well as system packages via apt-get.\n- [REMOTE_CODE_EXECUTION]: The skill workflow involves the agent dynamically generating and executing Python and JavaScript scripts to perform direct OOXML manipulation and document creation. This behavior allows for the execution of arbitrary code generated by the model based on its interpretation of document structures.\n- [COMMAND_EXECUTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external .docx files and processes them using powerful system tools and scripting environments.\n
Ingestion points: External documents are read and converted using pandoc and unpacked into raw XML for analysis.\n
Boundary markers: The instructions lack explicit boundary markers or warnings to the agent to disregard instructions potentially embedded within the ingested documents.\n
Capability inventory: The agent is granted access to high-privilege shell commands (sudo), standard CLI tools (pandoc, soffice), and the ability to run generated Python and Node.js scripts.\n
Sanitization: While the skill suggests using defusedxml for secure XML parsing, there is no broader sanitization strategy for handling malicious instructions that may be found in the text content of the documents being processed.

docx