docx
Warn
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Runtime compilation of a C library. Evidence found in scripts/office/soffice.py where the script writes C source code to a temporary file and executes gcc to compile a shared object (.so).
- [COMMAND_EXECUTION]: Library injection via LD_PRELOAD. Evidence found in scripts/office/soffice.py where the script sets the LD_PRELOAD environment variable to load the compiled library when executing soffice.
- [COMMAND_EXECUTION]: Execution of system utilities. Evidence found in scripts/accept_changes.py, scripts/office/soffice.py, and scripts/office/validators/redlining.py where the skill uses subprocess.run to call soffice, git, and pdftoppm.
- [PROMPT_INJECTION]: Indirect prompt injection surface. Ingestion points: scripts/office/unpack.py extracts XML content from user-provided .docx files. Boundary markers: Absent; the agent is instructed to edit raw XML. Capability inventory: Shell command execution and file writes. Sanitization: Uses defusedxml for XXE protection but does not sanitize document text against prompt injection.
Audit Metadata