The Agent Skills Directory

[PROMPT_INJECTION]: The skill's instructions contain mandatory directives that attempt to override standard agent behavior by requiring the reading of documentation files entirely without range limits ('NEVER set any range limits'), which attempts to control how the agent manages its context window.
[PROMPT_INJECTION]: Ingesting untrusted document data through extraction tools creates a vulnerability surface for indirect prompt injection. Ingestion points: Untrusted document data enters the agent's context through pandoc markdown conversion or raw XML extraction from word/document.xml. Boundary markers: There are no instructions to use delimiters or warnings to ignore embedded instructions for the content extracted from documents. Capability inventory: The skill can execute shell commands via subprocess.run() and write to the file system using library methods. Sanitization: No sanitization logic is provided to filter or validate instructions potentially embedded in document text.
[COMMAND_EXECUTION]: The skill uses subprocess.run() to execute local system tools for legitimate operations: soffice is used for document validation in ooxml/scripts/pack.py, and git is used for version comparison in ooxml/scripts/validation/redlining.py.
[EXTERNAL_DOWNLOADS]: Instructions in SKILL.md direct the user to install several well-known external tools and libraries, including pandoc, libreoffice, poppler-utils, and the docx Node.js package.

docx