The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file uses the dynamic context injection syntax (!command) to execute a Table of Contents utility (skill-toc). The command checks for the utility in the skill directory and the user's home directory ($HOME/.claude/skills/plugin-utils/bin/skill-toc). This is a benign documentation helper used to list references and scripts at skill load time.\n- [COMMAND_EXECUTION]: Several scripts utilize subprocess.run() to perform internal operations. For example, fix_footnotes.py executes the sibling script create_crossrefs.py using sys.executable, and refresh_noteref_caches.py (via the doc_render module) calls system binaries such as x2t or soffice for PDF rendering. These executions are necessary for the skill's primary document repair and rendering functions and follow safe patterns by avoiding shell=True.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it processes untrusted user-provided DOCX files. \n
Ingestion points: User-supplied DOCX files are processed by fix_footnotes.py, check_crossrefs.py, create_crossrefs.py, docx_links.py, docx_spacers.py, and refresh_noteref_caches.py.\n
Boundary markers: None; the agent processes the file content directly as data for repair tasks.\n
Capability inventory: The skill has file-writing capabilities (for document repair) and subprocess execution (for chaining scripts and invoking renderers).\n
Sanitization: The skill uses structured XML parsing (lxml) to modify document parts, which provides inherent structure validation, but it does not specifically filter for embedded natural language instructions targeted at the agent.

docx-repair