The Agent Skills Directory

[COMMAND_EXECUTION]: Runtime compilation and injection of shared libraries.
The script scripts/office/soffice.py contains hardcoded C source code which it writes to a temporary file and compiles into a shared object library (lo_socket_shim.so) using gcc at runtime.
This library is then injected into the LibreOffice (soffice) process via the LD_PRELOAD environment variable to intercept and redirect AF_UNIX socket calls. This is a high-complexity behavioral pattern.
[COMMAND_EXECUTION]: Execution of external CLI tools.
The skill makes extensive use of subprocess.run to invoke system utilities including soffice, pdftoppm, git, and gcc across multiple scripts (thumbnail.py, soffice.py, and redlining.py).
[PROMPT_INJECTION]: Indirect prompt injection surface through untrusted file processing.
Ingestion points: The skill reads and parses XML content from user-supplied .pptx files in scripts/office/unpack.py and the scripts/office/validators/ directory.
Boundary markers: The instructions do not define clear delimiters or include warnings for the agent to ignore instructions found within presentation XML files.
Capability inventory: The environment provides access to powerful tools like gcc and git, which could be abused if the agent is manipulated by malicious content within a processed presentation.
Sanitization: While defusedxml is used in several components to mitigate XXE, it does not prevent logic-based prompt injection.

pptx