The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes system commands to verify file types and control applications. In scripts/parse_complex_excel.py, the file command is invoked via subprocess.run using an argument list, which prevents shell injection vulnerabilities. The skill also documents the use of osascript (AppleScript) for controlling Microsoft Excel on macOS, correctly recommending the use of the timeout utility to ensure the agent does not hang on unresponsive UI elements.
[INDIRECT_PROMPT_INJECTION]: The skill operates as a data parser, which introduces a vulnerability surface for indirect prompt injection.
Ingestion points: The scripts/parse_complex_excel.py script reads and extracts data from user-provided .xlsx and .xlsm files.
Boundary markers: The extracted cell content is not wrapped in specific delimiters or accompanied by instructions to ignore potential instructions within the data.
Capability inventory: The skill includes the ability to execute shell commands via osascript and write files to the disk.
Sanitization: Cell data is extracted directly from the XML structure without filtering or sanitizing for malicious natural language instructions that could influence the agent's behavior.

excel-automation