The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/office/soffice.py implements a dynamic code generation and injection pattern. It defines an embedded C source string for a socket shim, writes it to a temporary file (lo_socket_shim.c), and executes gcc to compile a shared object library. It then applies the LD_PRELOAD environment variable to inject this library into the soffice binary execution environment. While used for sandbox compatibility, this technique is a significant technical risk vector.
[PROMPT_INJECTION]: The skill has an indirect prompt injection surface. (1) Ingestion points: Untrusted slide content enters the agent context in SKILL.md via the markitdown command. (2) Boundary markers: No delimiters or warnings are present to distinguish file content from instructions. (3) Capability inventory: The skill has extensive shell execution capabilities via subprocess.run calls in scripts/thumbnail.py and scripts/office/soffice.py. (4) Sanitization: External content is not sanitized before being processed by the agent.
[COMMAND_EXECUTION]: Several scripts utilize the subprocess module to run external system binaries. scripts/thumbnail.py executes soffice and pdftoppm, and scripts/office/validators/redlining.py invokes git. These subprocess calls increase the vulnerability surface if user-controlled filenames or metadata are processed.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of multiple third-party dependencies from public registries. These include Python packages like markitdown and Pillow, as well as Node.js packages including pptxgenjs, react-icons, and sharp.

pptx