The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted document files (.docx), which serves as an ingestion point for potential indirect prompt injection.
Ingestion points: Document contents are processed in ooxml/scripts/unpack.py and the core Document library in scripts/document.py.
Boundary markers: Instructions do not currently define explicit markers or warnings to the agent to ignore embedded instructions within document content.
Capability inventory: The skill executes system commands via subprocess.run (soffice, git) and performs local file system writes.
Sanitization: The skill implements mitigation for XML-based attacks using the defusedxml library in its primary data processing paths.
[COMMAND_EXECUTION]: The packing and redlining validation scripts (ooxml/scripts/pack.py, ooxml/scripts/validation/redlining.py) use subprocess.run() to call soffice and git for legitimate document processing tasks.
soffice: Used for document format validation via headless conversion.
git: Used for word-level diffing of tracked changes.
[PROMPT_INJECTION]: SKILL.md contains behavior-steering instructions intended to ensure the agent processes full library documentation before execution.
Patterns: Includes directives like "NEVER set any range limits when reading this file", which constrain agent tool usage to maintain context.
[DATA_EXFILTRATION]: Secondary validation scripts use standard XML parsers without explicit hardening, creating a theoretical exposure risk.
Evidence: ooxml/scripts/validation/docx.py, pptx.py, and redlining.py use lxml.etree and xml.etree.ElementTree for parsing XML content without explicitly disabling external entity resolution, which could theoretically be leveraged for XML External Entity (XXE) data exposure if processing a malicious document.

docx