The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/office.py executes the LibreOffice binary (soffice or libreoffice) to render documents to PDF and PNG.
It uses subprocess.run with an argument list rather than a shell string, which prevents shell injection vulnerabilities.
The script identifies the binary location using shutil.which and a list of standard installation paths for macOS and Windows.
It uses a fresh temporary profile via the -env:UserInstallation flag to ensure the rendering process is isolated from any existing user sessions.
[INDIRECT_PROMPT_INJECTION]: The skill processes external .docx files which may contain instructions intended to override the agent's behavior when the document content is read.
Ingestion points: The Document object in scripts/edit.py and the validate/render functions in scripts/office.py ingest untrusted OOXML data from external files.
Boundary markers: The documentation in SKILL.md explicitly warns that rendering is not a sandbox for unknown third-party files and cautions against opening embedded objects.
Capability inventory: The skill has the ability to execute subprocesses (LibreOffice), write new files to the file system (via zipfile and Path.open), and read arbitrary file content within permitted directories.
Sanitization: The skill uses the defusedxml library for all XML parsing to mitigate XML External Entity (XXE) and other XML-based attacks. It also implements checks for unsafe ZIP member paths (e.g., directory traversal via ..) during validation.

docx