The Agent Skills Directory

[DYNAMIC_EXECUTION]: The file scripts/office/soffice.py implements a runtime compilation and process injection mechanism. It writes a hardcoded C source code block to a temporary file (lo_socket_shim.c), compiles it into a shared library (lo_socket_shim.so) using the system gcc compiler, and then forces the library to be loaded into the soffice process by setting the LD_PRELOAD environment variable. This is documented as a shim to handle restricted AF_UNIX socket environments.
[COMMAND_EXECUTION]: Several scripts utilize the subprocess module to execute external system binaries with varying levels of complexity: scripts/office/soffice.py executes gcc to build the socket shim; scripts/thumbnail.py executes soffice for PDF conversion and pdftoppm for image generation; scripts/office/validators/redlining.py executes git diff to compare document text versions.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of PowerPoint and Word files, creating an attack surface for indirect prompt injection. 1. Ingestion points: The skill extracts and parses XML content from documents in files like scripts/office/unpack.py, scripts/add_slide.py, and the validation scripts. 2. Boundary markers: There are no explicit boundary markers or instructions to the AI to ignore instructions embedded within the document XML during parsing. 3. Capability inventory: The skill has the capability to write to the file system, execute arbitrary shell commands (via subprocess and gcc), and perform library injection. 4. Sanitization: While defusedxml is employed to mitigate standard XML vulnerabilities, the extracted text content is not sanitized to prevent instructions from influencing the agent's logic.

pptx