The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external .docx files provided by the user to extract text, comments, and revision history. This content is untrusted and could contain malicious instructions designed to manipulate the behavior of the agent reading the output.
Ingestion points: Untrusted content is ingested from the document path passed to scripts/extract_review.py and processed via the docx_bridge_client.py library.
Boundary markers: The skill outputs the extracted content into Markdown tables but does not provide specific boundary markers or instructions to the agent to treat the document content as untrusted data.
Capability inventory: The skill can execute internal scripts via subprocess.run and read local files. It does not possess direct file-writing or network exfiltration capabilities.
Sanitization: The output logic in extract_review.py escapes markdown table delimiters (|) to maintain table structure, but does not perform content sanitization against prompt injection attacks.
[COMMAND_EXECUTION]: The Python client in scripts/bridge_lib/docx_bridge_client.py uses subprocess.run to invoke the dotnet-script binary. The implementation is secure as it passes arguments as a list and uses the -- separator to ensure the file path is treated as an argument rather than a command-line flag, preventing shell-based injection.
[EXTERNAL_DOWNLOADS]: The skill's C# logic, defined in .csx files, declares a dependency on the DocumentFormat.OpenXml library. This package is automatically retrieved from the NuGet registry during the first execution. NuGet is a well-known service, and the library is a standard package maintained by a trusted vendor.
[DYNAMIC_EXECUTION]: The skill executes C# logic at runtime using the dotnet-script runner. These scripts (extract_views.csx, list_comments.csx, list_revisions.csx) are part of the skill's own source code and are used to perform high-fidelity XML parsing that standard Python libraries often fail to handle correctly.

read-docx-review