docx
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes external system utilities using the Python
subprocessmodule to manage document conversions and comparisons. - In
ooxml/scripts/pack.py, the skill callssoffice(LibreOffice) to validate repacked Office files by converting them to HTML in a temporary directory. - In
ooxml/scripts/validation/redlining.py, the skill utilizesgit diffto generate precise character-level and word-level diffs for verifying that document edits are correctly tracked. - These calls are implemented securely using a list of arguments and avoiding shell execution, preventing potential command injection via manipulated file paths.
- [SAFE]: The skill incorporates security best practices throughout its document processing workflows.
- Secure XML parsing is enforced using the
defusedxmllibrary in all relevant scripts (scripts/utilities.py,scripts/document.py,ooxml/scripts/pack.py,ooxml/scripts/unpack.py), effectively protecting against XML External Entity (XXE) and other XML-based attacks. - The validation framework ensures that all modifications adhere to OOXML schemas and internal tracked change rules before finalizing documents.
- The skill uses standard, well-known technologies like Pandoc and LibreOffice for its primary conversion tasks.
Audit Metadata