The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes several external system commands via the subprocess module to handle document processing. In scripts/office/soffice.py, it executes gcc to compile a compatibility shim. In scripts/office/validators/redlining.py, it uses git diff for comparing document text. It also launches soffice (LibreOffice) and pdftoppm for conversion tasks.
[REMOTE_CODE_EXECUTION]: The skill performs dynamic code generation and process injection in scripts/office/soffice.py. The script writes an embedded C source string to a temporary file, compiles it into a shared library using gcc, and then injects this library into the soffice process using the LD_PRELOAD environment variable. While intended to facilitate Unix socket communication in restricted environments, this runtime compilation and injection pattern is a high-risk behavior.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted external data from document files.
Ingestion points: scripts/office/unpack.py extracts raw XML and text content from user-provided .docx files and places it in the agent's context.
Boundary markers: Absent. The instructions do not provide delimiters or warnings to ensure the agent ignores instructions found within the document data.
Capability inventory: The agent has access to powerful bash tools and file-writing capabilities, which could be abused if it follows instructions embedded in a document.
Sanitization: While the scripts use defusedxml to prevent XML-level exploits, they do not sanitize or filter the extracted document text for AI-targeted instructions.

docx