The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources (JSON, XML, and custom patch files) and writes it to spreadsheet cells. This creates a surface for formula injection (CSV injection) where malicious input could be executed as a command if the file is opened in LibreOffice or Excel.
Ingestion points: The source parameter in scripts/calc/core.py, the patch_text processed in scripts/calc/patch.py, and the cell values written via scripts/calc/session.py.
Boundary markers: No specific delimiters or warnings are present to instruct the agent to ignore instructions embedded within the processed data.
Capability inventory: The skill possesses file-write capabilities using the doc.storeToURL and doc.storeAsURL methods in scripts/calc/core.py and scripts/calc/session.py. It also has the ability to trigger command execution by starting the LibreOffice process via scripts/uno_bridge.py.
Sanitization: The skill lacks sanitization or escaping mechanisms to prevent data starting with '=' from being interpreted as a formula.
[DYNAMIC_EXECUTION]: The scripts/uno_bridge.py script dynamically modifies the Python system path (sys.path) and uses the importlib library to locate and load the uno module from various host-specific LibreOffice directories. While required for integration, dynamic loading from computed paths is a sensitive capability.
[COMMAND_EXECUTION]: The skill uses subprocess.Popen in scripts/uno_bridge.py to launch the LibreOffice binary in headless mode. This is the intended behavior for the UNO bridge, and the command arguments are not directly controllable by external user input, which mitigates injection risks.

libreoffice-calc