The Agent Skills Directory

[SAFE]: The skill correctly implements secure XML handling by utilizing the defusedxml library in its core manipulation and validation scripts (e.g., ooxml/scripts/unpack.py, scripts/document.py, and scripts/utilities.py), protecting against XML External Entity (XXE) and entity expansion attacks.
[COMMAND_EXECUTION]: The skill uses external tools for document processing, conversion, and validation.
ooxml/scripts/pack.py uses soffice (LibreOffice) for document validation by converting files to HTML.
ooxml/scripts/validation/redlining.py uses git diff for comparing document text content.
These calls are implemented using subprocess.run with list-based arguments and no shell involvement, which mitigate command injection vulnerabilities.

docx