The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/office/soffice.py writes a C source string to a temporary file and compiles it at runtime using gcc into a shared object (.so).
It then uses the LD_PRELOAD environment variable to inject this library into the soffice process to shim AF_UNIX socket behavior.
This technique is used to bypass sandbox restrictions but represents a high-risk dynamic execution pattern.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted .docx files by unpacking them into XML for the agent to read and edit.
Ingestion points: Untrusted data enters via scripts/office/unpack.py which extracts XML from user-provided documents.
Boundary markers: Absent. There are no delimiters or instructions to ignore commands embedded within the document XML during the editing process.
Capability inventory: The skill has significant capabilities including shell execution (soffice, gcc, git via subprocess.run) and file system write access.
Sanitization: The skill correctly uses defusedxml for XML parsing, which mitigates technical XML attacks like XXE, but does not sanitize the semantic content against prompt injection.
[COMMAND_EXECUTION]: The skill executes multiple external shell commands via subprocess.run across several scripts:
scripts/office/soffice.py executes gcc for compilation and soffice for document conversion.
scripts/accept_changes.py executes soffice to run macros.
scripts/office/validators/redlining.py executes git diff to validate changes.

docx