The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file uses imperative override language to control the agent's behavior during documentation processing, specifically commands like 'MANDATORY
READ ENTIRE FILE' and 'NEVER set any range limits'.
[COMMAND_EXECUTION]: The skill relies on executing system binaries for core functionality via subprocess.run with shell=False:
ooxml/scripts/pack.py executes soffice (LibreOffice) to perform document conversion and validation.
ooxml/scripts/validation/redlining.py executes git diff to provide word-level and character-level comparisons between document versions.
[PRIVILEGE_ESCALATION]: SKILL.md documentation instructs the agent or user to install dependencies using sudo apt-get install for packages like pandoc, libreoffice, and poppler-utils. This facilitates the use of elevated privileges within the execution environment.
[INDIRECT_PROMPT_INJECTION]: The skill's primary operation involves unpacking and reading XML data from external Word documents, which is a classic vector for indirect prompt injection.
Ingestion points: External document content is ingested in ooxml/scripts/unpack.py, processed for validation in ooxml/scripts/validation/base.py, and edited via the Document library in scripts/document.py.
Boundary markers: Absent. The skill does not implement delimiters or provide instructions to the agent to treat document content as potentially adversarial text.
Capability inventory: The agent has the capability to write to the local filesystem and execute system commands (soffice, git) based on the data it reads.
Sanitization: While the skill correctly uses defusedxml to mitigate XML-specific infrastructure attacks (such as XXE), it performs no sanitization or filtering of the natural language instructions contained within the documents themselves.

docxmakebetter