The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/office/soffice.py uses high-risk runtime code generation and process injection techniques.
It contains a C source code block (_SHIM_SOURCE) that is written to a temporary file and compiled on the fly using gcc into a shared object (.so).
This resulting library is then injected into the LibreOffice (soffice) execution environment using the LD_PRELOAD environment variable to shim networking functions.
[COMMAND_EXECUTION]: Multiple scripts execute external system binaries to perform document tasks.
scripts/office/soffice.py invokes gcc for compilation and soffice for document operations.
scripts/accept_changes.py executes soffice with headless flags and custom installation paths.
scripts/office/validators/redlining.py invokes git diff to compare extracted text content.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Office Open XML (.docx/.dotx) files, presenting a vulnerability surface for indirect injection.
Ingestion points: External document content is ingested via unzip and parsed into the agent's context by scripts such as scripts/merge_runs.py and scripts/office/validate.py.
Boundary markers: While SKILL.md contains a manual warning to the agent that documents from external parties are untrusted, there are no programmatic delimiters or 'ignore' instructions wrapping the parsed content when it is processed.
Capability inventory: The skill possesses high-privilege capabilities including arbitrary file system writes, runtime compilation, and shell command execution, which could be leveraged if an ingested document successfully influences agent behavior.
Sanitization: The skill uses defusedxml to protect against some XML-based attacks (like XXE), but it does not sanitize the natural language content extracted from the XML before it enters the LLM context.

docx