The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external PowerPoint files by converting them to Markdown and extracting text from various shapes. There are no boundary markers or explicit instructions to treat this ingested content as untrusted, which creates a surface for indirect prompt injection if a presentation contains malicious instructions.
Ingestion points: Data enters the agent's context through markitdown output and the inventory.py and unpack.py scripts.
Boundary markers: None identified in the instructional content or scripts.
Capability inventory: The skill has the ability to execute shell commands and render content via a headless browser.
Sanitization: defusedxml is used in several scripts to prevent XML External Entity (XXE) attacks.
[COMMAND_EXECUTION]: The skill invokes several external utilities including LibreOffice (soffice), Poppler (pdftoppm), and git using subprocess.run.
These calls use argument lists rather than shell strings, which effectively prevents shell injection vulnerabilities.
The unpack.py and redlining.py scripts use ZipFile.extractall() to decompress PowerPoint files. These calls lack validation to ensure that extracted paths remain within the target directory, making the scripts potentially vulnerable to Zip Slip attacks if a malicious archive with parent directory references (../) is processed.
[DYNAMIC_EXECUTION]: Slide creation involves the html2pptx.js script, which uses the Playwright library to launch a Chromium instance for rendering HTML slides. This process executes Javascript within the browser context to calculate positions and styles, which is a necessary function for the skill's purpose but represents a significant execution capability.

pptx