docx

Pass

Audited by Gen Agent Trust Hub on Jun 24, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes external system utilities using the Python subprocess module to manage document conversions and comparisons.
  • In ooxml/scripts/pack.py, the skill calls soffice (LibreOffice) to validate repacked Office files by converting them to HTML in a temporary directory.
  • In ooxml/scripts/validation/redlining.py, the skill utilizes git diff to generate precise character-level and word-level diffs for verifying that document edits are correctly tracked.
  • These calls are implemented securely using a list of arguments and avoiding shell execution, preventing potential command injection via manipulated file paths.
  • [SAFE]: The skill incorporates security best practices throughout its document processing workflows.
  • Secure XML parsing is enforced using the defusedxml library in all relevant scripts (scripts/utilities.py, scripts/document.py, ooxml/scripts/pack.py, ooxml/scripts/unpack.py), effectively protecting against XML External Entity (XXE) and other XML-based attacks.
  • The validation framework ensures that all modifications adhere to OOXML schemas and internal tracked change rules before finalizing documents.
  • The skill uses standard, well-known technologies like Pandoc and LibreOffice for its primary conversion tasks.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 24, 2026, 06:16 PM
Security Audit — agent-trust-hub — docx