The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the officecli command-line utility to perform document modifications, such as embedding pictures and setting wrap properties in .docx files.
[DYNAMIC_EXECUTION]: The provided script scripts/svg.py implements SVG support by performing runtime monkey-patching of the python-docx library. It replaces internal factory methods to allow the library to recognize and process SVG MIME types and signatures. This modification is localized to the skill's execution context and supports its primary stated purpose.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes SVG files, which are XML-based, creating a potential surface for malicious data processing.
Ingestion points: SVG files (e.g., chart.svg) are read into memory and parsed using the xml.etree.ElementTree module in scripts/svg.py.
Boundary markers: No explicit security delimiters or boundary markers are used when processing the file content.
Capability inventory: The skill has the capability to write files to the local system (doc.save) and execute shell commands (officecli).
Sanitization: The script uses the standard xml.etree.ElementTree parser which, by default, is susceptible to XML external entity (XXE) attacks if processing untrusted input. While no malicious intent is present, using a hardened parser like defusedxml would be a recommended security best practice for handling external graphics.

docx-svg