The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes officecli to manipulate .docx files, including adding and configuring SVG images.
[EXTERNAL_DOWNLOADS]: The skill uses the uv package manager to automatically resolve and install well-known dependencies (python-docx and docxtpl) required for the Python-based fallback method.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied or external SVG data through xml.etree.ElementTree to extract image dimensions. This represents a potential attack surface for malformed XML data, although it is within the expected functionality of the skill.
Ingestion points: The scripts/svg.py script reads SVG file content provided as a file path or stream.
Boundary markers: No specific boundary markers or instructions to ignore embedded XML content are provided.
Capability inventory: The skill has the ability to execute shell commands (officecli) and write to the local file system (doc.save, tpl.save).
Sanitization: The script uses the standard xml.etree.ElementTree library to parse SVG headers; it does not use specialized libraries like defusedxml to mitigate XML-based attacks.

docx-svg