The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/office/soffice.py implements a dynamic execution pattern where it generates C source code at runtime, compiles it into a shared library using gcc, and injects it into the LibreOffice process via the LD_PRELOAD environment variable. While documented as a shim for socket compatibility, it involves high-risk process injection techniques.
[COMMAND_EXECUTION]: The skill performs several direct shell command executions using subprocess.run across different modules:
scripts/office/soffice.py executes the gcc compiler to create the socket shim.
scripts/recalc.py executes the soffice binary with specific arguments to trigger internal macros.
scripts/office/validators/redlining.py executes git diff for text comparison.
scripts/recalc.py writes a StarBasic macro file (Module1.xba) to the user's local application configuration directory (e.g., ~/.config/libreoffice/4/user/basic/Standard/).
[PROMPT_INJECTION]: The skill has a significant surface for indirect prompt injection (Category 8) because it processes untrusted spreadsheet files:
Ingestion points: Untrusted data enters the agent context via ZIP extraction in scripts/office/unpack.py and spreadsheet reading logic in SKILL.md.
Boundary markers: Absent. There are no delimiters or explicit warnings provided to the agent to ignore instructions embedded within the spreadsheet data.
Capability inventory: The skill has extensive capabilities including subprocess calls (soffice, gcc, git) and file-writing across multiple scripts.
Sanitization: While defusedxml is used to prevent XML-based attacks during parsing, the content of cells and formulas is passed to LibreOffice for execution without comprehensive sanitization.

xlsx