The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted PowerPoint presentations, creating a path for malicious instructions to be ingested by the agent context.\n
Ingestion points: Presentations are ingested through scripts/inventory.py and ooxml/scripts/unpack.py.\n
Boundary markers: Extracted text is provided to the agent without specialized delimiters or 'ignore' warnings for embedded instructions.\n
Capability inventory: The skill has access to command execution (subprocess.run) and browser automation (playwright).\n
Sanitization: XML parsing is hardened with defusedxml in primary scripts, but textual content extracted from presentations is not sanitized before prompt interpolation.\n- [COMMAND_EXECUTION]: The skill executes external command-line utilities including LibreOffice (soffice), Poppler (pdftoppm), and git using the subprocess.run function. These commands are used for document format conversion, thumbnail generation, and change tracking, utilizing structured argument lists without a shell context.\n- [DYNAMIC_EXECUTION]: The scripts/html2pptx.js utility launches a Chromium instance via the Playwright library. It executes JavaScript logic within the browser using page.evaluate to calculate element styles and layout dimensions during slide conversion. This execution is necessary for the skill's primary function and is confined to the browser's sandbox environment.\n- [PERSISTENCE]: The ooxml/scripts/unpack.py and ooxml/scripts/validation/base.py scripts utilize zipfile.extractall() on input presentation files without validating entry paths. This introduces a path traversal risk (Zip Slip), where a malicious presentation could contain filenames like ../../.bashrc to overwrite sensitive local files and maintain persistent access.\n- [DATA_EXFILTRATION]: The ooxml/scripts/validation/redlining.py script uses the standard xml.etree.ElementTree library to parse document XML. Unlike the skill's primary scripts, this validator is not hardened against XML External Entity (XXE) attacks, which could allow a malicious document to read and exfiltrate sensitive local data.

pptx