The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's setup and environment check scripts (scripts/setup.sh, scripts/setup.ps1, scripts/env_check.sh) download the .NET SDK installation script from the official Microsoft domain at https://dot.net/v1/dotnet-install.sh. These downloads originate from a well-known, trusted service used for platform initialization.
[REMOTE_CODE_EXECUTION]: Automated alerts identified the execution of the downloaded .NET installation script. This behavior is confined to the initial environment setup and uses an official deployment script from a trusted technology vendor.
[COMMAND_EXECUTION]: The skill utilizes shell scripts and the dotnet CLI for administrative tasks such as environment verification, project building, and document previewing via Pandoc or LibreOffice. These commands are necessary for the skill's primary function and are used in a transparent, non-malicious manner.
[PROMPT_INJECTION]: The skill processes document files which serve as a potential surface for indirect prompt injection.
Ingestion points: DOCX files and supporting data formats (JSON, CSV) used for content replacement and table population in CreateCommand.cs and EditContentCommand.cs.
Boundary markers: The skill instructions emphasize a "validation pipeline" and "hard gate-check" using XSD schemas to ensure document structural integrity.
Capability inventory: The tool has file system access for document operations and utilizes shell commands for development workflows.
Sanitization: Processing is handled through the .NET OpenXML SDK, which treats document content as structured XML data rather than executable instructions.

minimax-docx