The Agent Skills Directory

[COMMAND_EXECUTION]: The bundled script scripts/render_docx.py uses subprocess.run to call soffice (LibreOffice) for document conversion. The arguments are constructed as lists rather than shell strings, and paths are expanded or absolute, which significantly reduces command injection risks. The usage of soffice with a dedicated -env:UserInstallation profile in a temporary directory is a security best practice to avoid profile locking and isolation issues.
[EXTERNAL_DOWNLOADS]: The skill instructions advise installing standard, well-known libraries (python-docx, pdf2image) and system utilities (libreoffice, poppler-utils) from official package managers like pip, brew, or apt. These are routine dependencies for the stated purpose of the skill and do not involve untrusted remote code execution.
[SAFE]: The skill behavior matches its stated purpose as a document processing tool. The metadata identifies it as a curated skill, and the provided Python code follows standard patterns for interacting with external CLI tools and XML document formats (OOXML). No signs of obfuscation, persistence, or malicious data exfiltration were detected.

doc