The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The utility scripts/office/soffice.py contains a hardcoded C source code string (_SHIM_SOURCE). On execution, the script writes this source to the temporary directory and invokes gcc via a subprocess to compile it into a shared library (lo_socket_shim.so).
[REMOTE_CODE_EXECUTION]: The skill performs process injection by launching the soffice (LibreOffice) binary with the LD_PRELOAD environment variable set to the path of the dynamically compiled library. This shim intercepts and modifies system calls related to networking (e.g., socket, listen, accept) to bypass AF_UNIX restrictions in restricted environments.
[COMMAND_EXECUTION]: Multiple scripts within the skill (scripts/office/soffice.py, scripts/recalc.py, scripts/office/validators/redlining.py) use subprocess.run to execute system binaries, including gcc, soffice, git, and timeout.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it processes untrusted spreadsheet data (XLSX, CSV) while having high-risk capabilities like command execution and runtime compilation. Mandatory Evidence Chain: 1. Ingestion points: Untrusted data is loaded via pd.read_excel and load_workbook (SKILL.md). 2. Boundary markers: Absent; no special delimiters or instructions are used to separate untrusted cell content or formulas from agent commands. 3. Capability inventory: High-risk subprocess calls and compilation tools in soffice.py and recalc.py. 4. Sanitization: Absent; no validation or filtering of formula content or structured data is performed before processing.

xlsx