The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/office/soffice.py contains embedded C source code that is written to the temporary directory and compiled at runtime using gcc. The resulting shared object is then loaded into the execution environment via LD_PRELOAD. This is used to shim AF_UNIX socket operations for LibreOffice in sandboxed environments. While the source code is static, the capability to compile and inject native code is a high-privilege operation.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external Word documents, creating a potential attack surface for indirect prompt injection.
Ingestion points: Documents are processed via scripts/office/unpack.py (XML extraction) and the pandoc extraction examples provided in SKILL.md.
Boundary markers: The skill does not define or use explicit boundary markers or instruction-guarding delimiters when presenting extracted text to the agent context.
Capability inventory: The skill has powerful capabilities, including executing external binaries via subprocess.run (soffice, pandoc, git, gcc) and arbitrary file system write access via scripts/office/pack.py.
Sanitization: There is no evidence of sanitization or filtering applied to the text or XML content extracted from documents.
[COMMAND_EXECUTION]: The skill frequently uses subprocess.run to call system utilities such as soffice, pandoc, pdftoppm, and git. These implementations use argument lists (not shell=True), which correctly mitigates standard shell injection vulnerabilities.

docx