The Agent Skills Directory

[PROMPT_INJECTION]: The skill has an indirect prompt injection surface (Category 8). It ingests untrusted data from user-provided .pptx presentations and renders HTML content, which could be exploited if malicious instructions are embedded in templates. This risk is combined with capabilities like subprocess execution and file system writes. Ingestion points: scripts/inventory.py and scripts/html2pptx.js.\n- [COMMAND_EXECUTION]: The skill utilizes subprocess.run to call system tools like LibreOffice (soffice) and Poppler (pdftoppm) for document conversion. While arguments are handled safely as lists, executing complex utilities on untrusted data remains a potential attack vector. Evidence found in ooxml/scripts/pack.py and scripts/thumbnail.py.\n- [SAFE]: Core XML processing in unpack.py and pack.py correctly uses defusedxml to mitigate risks such as entity expansion attacks.\n- [SAFE]: The skill relies on lxml for XML schema validation without explicitly disabling external entity resolution in all modules (ooxml/scripts/validation/base.py). While this is a best practice violation for handling untrusted XML, it is common in document processing tools.

pptx