The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run calls across multiple files (core/input_conversion.py, core/field_refresh.py, core/render.py) to invoke system binaries such as soffice (LibreOffice), winword.exe (Microsoft Word), wps.exe, and font management tools like fc-list. These are used for converting legacy formats to .docx, refreshing document fields, and rendering pages for inspection.
[DATA_EXFILTRATION]: In core/llm.py, the _upload_image function transmits file data to public domains including litterbox.catbox.moe, catbox.moe, and 0x0.st. This capability is used to host document snapshots when a multi-modal LLM endpoint does not support direct base64 uploads. While this is gated by the LLM_ALLOW_PUBLIC_IMAGE_UPLOAD environment variable and documented in .env.example, it represents a high risk of data exposure for sensitive documents.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied Word documents and interpolates extracted text into prompts sent to the LLM for role labeling.
Ingestion points: core/extract.py reads content from all document stories including body, textboxes, and comments.
Boundary markers: While the prompt template in core/label_roles.py provides structure, the ingested paragraph text is inserted directly into the JSON-formatted payload without specialized sanitization.
Capability inventory: The skill possesses powerful capabilities including shell command execution and network access, which could be abused if an injected document successfully influences the agent's logic.
Sanitization: No robust filtering or escaping of the ingested text is performed before it is sent to the model context.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to external LLM providers and the aforementioned public file hosting services using the requests library.

format-agent