The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The scripts ooxml/scripts/unpack.py and ooxml/scripts/validation/redlining.py use zipfile.extractall() to extract user-provided Office documents without validating that the archive's member paths are safe. This creates a 'Zip Slip' vulnerability where a malicious document can use directory traversal sequences (e.g., ../) to overwrite sensitive files elsewhere on the system.
[COMMAND_EXECUTION]: The validation modules (specifically ooxml/scripts/validation/base.py) use the standard lxml.etree parser on untrusted Office XML files without explicitly disabling external entity resolution. This inconsistency with other parts of the skill (which use defusedxml) leaves the environment vulnerable to XML External Entity (XXE) attacks, potentially leading to local file disclosure or server-side request forgery.
[PROMPT_INJECTION]: Instructions in SKILL.md include override markers such as 'MANDATORY
READ ENTIRE FILE' and 'NEVER set any range limits' which are designed to bypass the agent's standard file-reading protocols and context management optimizations.
[METADATA_POISONING]: There is a deceptive discrepancy between the skill author context ('enuno') and the copyright holder and license terms specified in LICENSE.txt ('Anthropic, PBC'), which could mislead users or administrators about the skill's origin and safety.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Untrusted Office XML files are processed via unpack.py and validation scripts.
Boundary markers: Absent; there are no clear delimiters or instructions to ignore embedded commands within the ingested XML data.
Capability inventory: Subprocess execution of powerful tools (LibreOffice, Git, Pandoc) and arbitrary file system write capabilities via zip extraction.
Sanitization: Inconsistent; the skill mixes secure parsers (defusedxml) with potentially unsafe standard parsers in validation workflows.

docx