The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions and environment check scripts recommend installing the required OfficeCLI utility by executing a remote PowerShell script directly from a GitHub repository: irm https://raw.githubusercontent.com/iOfficeAI/OfficeCLI/main/install.ps1 | iex. This method of executing unverified remote scripts is a significant security risk, as it bypasses local review of the code being run.
[COMMAND_EXECUTION]: The backend operations, particularly in scripts/officecli_backend.py and scripts/check_playwright_cli.py, involve the use of subprocess.run to call external command-line tools like officecli and playwright-cli. These calls often use arguments and file paths extracted from the project under analysis. Furthermore, the environment check for Playwright uses shell=True on Windows systems, which can be vulnerable to command injection if input parameters are not perfectly sanitized.
[PRIVILEGE_ESCALATION]: The installation procedures for the skill's dependencies—specifically the global installation of @playwright/cli via npm install -g and the PowerShell installation script for OfficeCLI—require the user to have administrative or elevated system privileges, increasing the potential impact of any malicious code executed during these steps.
[INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting and analyzing untrusted project artifacts, including source code files and documentation in various formats (PDF, DOCX). These contents are processed by the AI to generate business context and user manuals. This workflow establishes an attack surface where maliciously crafted project files could attempt to influence the model's output or the subsequent automated steps.
Ingestion points: scripts/analyze_project.py and scripts/generate_business_context.py are designed to crawl and read local project files.
Boundary markers: While the workflow includes human review of generated Markdown drafts, the prompts themselves lack clear technical delimiters to separate untrusted data from instructions.
Capability inventory: The skill possesses the ability to write files to the local system and execute shell commands via subprocess calls.
Sanitization: The scripts include basic text processing (e.g., stripping Markdown markers and normalizing spaces), but these measures are primarily for content formatting rather than security-hardened sanitization.

software-copyright-materials