The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted PowerPoint (.pptx) files using scripts like scripts/inventory.py and ooxml/scripts/unpack.py to extract text and XML content. This content is then provided to the agent, creating a surface for indirect prompt injection if the processed document contains malicious instructions. (1) Ingestion points: scripts/inventory.py and ooxml/scripts/unpack.py extract content from user-provided files. (2) Boundary markers: The skill does not explicitly define markers to separate extracted document content from system instructions. (3) Capability inventory: The skill can write files to the system (scripts/replace.py) and execute shell commands (ooxml/scripts/pack.py). (4) Sanitization: No specific text sanitization is performed on the extracted content before it enters the agent's context.
[COMMAND_EXECUTION]: Several scripts execute system utilities using subprocess.run to perform necessary document processing tasks. (1) ooxml/scripts/pack.py: Calls soffice (LibreOffice) to validate documents during the repacking process. (2) scripts/thumbnail.py: Calls soffice and pdftoppm to generate visual thumbnails of slides. (3) ooxml/scripts/validation/redlining.py: Calls git to generate diffs for document validation. These calls are restricted to specific, well-known utilities and are used for their intended purposes, though they involve interacting with external executables.

pptx