The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied Powerpoint presentations by extracting slide text (via 'markitdown') and rendering images for visual inspection by the AI agent. This workflow creates an ingestion point for indirect prompt injection where instructions embedded within the slides could influence or override the agent's behavior. In SKILL.md, the agent is instructed to perform visual analysis of rendered images, which could contain adversarial content. There are no boundary markers or explicit isolation rules used to sanitize the extracted document content.
[COMMAND_EXECUTION]: The skill instructions and documentation specify the use of external binaries 'soffice' (LibreOffice) and 'pdftoppm' (Poppler) to convert presentations into images. These operations involve generating and executing shell commands on arguments derived from potentially untrusted input filenames. Evidence of this pattern is found in SKILL.md and references to scripts such as 'scripts/office/soffice.py'.
[EXTERNAL_DOWNLOADS]: SKILL.md identifies several third-party dependencies required for its document and image processing functionality, including 'markitdown', 'Pillow', and 'pptxgenjs'. These are well-established libraries fetched from public package registries (PyPI and NPM).
[DYNAMIC_EXECUTION]: The helper script 'scripts/office/helpers/simplify_redlines.py' utilizes the 'xml.etree.ElementTree' library for parsing XML files within processed presentations. This parser is vulnerable to XML External Entity (XXE) attacks when processing untrusted inputs. Although other scripts in the skill correctly use the safer 'defusedxml' library, this specific instance remains a potential security vulnerability.

powerpoint