The Agent Skills Directory

[COMMAND_EXECUTION]: Several Python utility scripts (unpack.py, base.py, docx.py, redlining.py) utilize zipfile.ZipFile.extractall() to extract presentation content without validating that the archive entry paths are restricted to the target directory. This creates a ZipSlip vulnerability surface where a crafted .pptx file could perform directory traversal and overwrite arbitrary files in the environment.
[COMMAND_EXECUTION]: Multiple scripts (thumbnail.py, pack.py, redlining.py) execute system binaries using subprocess.run(), including soffice, pdftoppm, and git. These tools represent a significant capability surface that is accessible when processing user-provided documents.
[PROMPT_INJECTION]: The skill's primary workflow involves reading and analyzing external PowerPoint content through text extraction and raw XML inspection, which establishes an indirect prompt injection surface.
Ingestion points: Slide text extracted via markitdown and raw XML data from ppt/slides/slide{N}.xml as described in SKILL.md.
Boundary markers: The instructions do not include markers or warnings for the agent to ignore embedded instructions within processed data.
Capability inventory: Extensive system access via subprocess calls, browser automation via Playwright, and file system write operations.
Sanitization: While defusedxml is used for XML parsing to mitigate XML-based attacks (XXE), there is no sanitization or filtering applied to the natural language content extracted from presentations.
[EXTERNAL_DOWNLOADS]: The skill configuration documents the use of standard, well-known software and libraries (e.g., playwright, sharp, LibreOffice) fetched from official package registries and system repositories.

pptx