The Agent Skills Directory

[SAFE]: The skill utilizes defusedxml for all primary XML parsing tasks, which protects against XML External Entity (XXE) and expansion attacks. Metadata such as author names are correctly escaped using html.escape before being written to XML files. No security issues were detected.- [COMMAND_EXECUTION]: The skill executes soffice (LibreOffice) and git via subprocess.run for document validation and diffing. These invocations are implemented securely using argument lists and controlled paths, preventing arbitrary command injection.- [INDIRECT_PROMPT_INJECTION]: Document ingestion surfaces are secured via the use of the defusedxml library and XML metadata escaping, minimizing the risk from untrusted file content while maintaining primary functionality.

docx