The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill setup process involves downloading and executing installation scripts from https://d.officecli.ai/install.sh and https://d.officecli.ai/install.ps1. These domains are associated with the OfficeCLI tool and its author, iofficeai, and are considered legitimate vendor resources.
[COMMAND_EXECUTION]: The skill includes a Python helper script (reference/morph-helpers.py) and various shell scripts (build.sh) that execute the officecli tool. The Python implementation correctly uses list-based arguments in subprocess.run to prevent shell injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from .pptx files, which constitutes an attack surface for indirect prompt injection if the processed files contain adversarial content.
Ingestion points: Structured slide data is read in reference/morph-helpers.py using officecli get ... --json calls.
Boundary markers: Not present; the tool relies on the binary parsing provided by the underlying CLI tool to isolate content.
Capability inventory: The skill has the ability to execute system commands via subprocess.run and modify the filesystem using officecli commands.
Sanitization: No specific sanitization of shape names or text content is performed before processing by the helper library, which is consistent with the tool's primary purpose of technical presentation construction.

morph-ppt