The Agent Skills Directory

[DYNAMIC_EXECUTION]:
The file scripts/office/soffice.py dynamically generates C source code, writes it to a temporary file, and compiles it into a shared object library using gcc at runtime.
The skill uses the LD_PRELOAD environment variable to inject the compiled shim into the soffice process to intercept and modify Unix domain socket system calls.
[COMMAND_EXECUTION]:
The skill executes multiple external binaries using shell commands, including gcc (for library compilation), soffice (LibreOffice), git (for document text comparison in scripts/office/validators/redlining.py), and system timeout utilities (timeout, gtimeout).
[METADATA_POISONING]:
The skill package contains a large volume of code and configuration (XSD schemas, docx.py, pptx.py) for validating Word and PowerPoint documents. This inclusion is inconsistent with the SKILL.md manifest, which explicitly limits the skill to Excel files and instructs the agent not to use it for Word documents, representing hidden or out-of-scope capabilities.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill processes untrusted spreadsheet data from .xlsx, .csv, and .tsv files (SKILL.md).
Boundary markers: Absent. External data is interpolated into the agent context without delimiters or warnings to ignore potential instructions embedded in cell content.
Capability inventory: The skill possesses capabilities to execute shell commands and write to the filesystem.
Sanitization: While the skill uses defusedxml to mitigate XML-based attacks, it lacks sanitization for spreadsheet content that might contain instructions targeting the AI agent.

xlsx