The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill contains an untrusted data ingestion surface that makes it susceptible to indirect prompt injection if malicious documents are processed.
Ingestion points: Document data enters the context via create_document (sourcing .md files) in scripts/writer/core.py and WriterSession (loading .odt files) in scripts/writer/session.py.
Boundary markers: Absent; no delimiters or instructions are used to isolate untrusted document content.
Capability inventory: Spawns a headless LibreOffice process via subprocess.Popen in scripts/uno_bridge.py and performs document mutation/export using the UNO API.
Sanitization: Absent; content is parsed and passed directly to the LibreOffice filters.
[COMMAND_EXECUTION]: The file scripts/uno_bridge.py calls subprocess.Popen to launch a headless instance of LibreOffice (soffice or libreoffice). This command execution is benign as it uses a safe array of arguments, does not use shell=True, and is required for the core functionality of the UNO bridge.

libreoffice-writer