The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Multiple Python scripts, including ooxml/scripts/unpack.py, ooxml/scripts/validation/base.py, ooxml/scripts/validation/docx.py, and ooxml/scripts/validation/redlining.py, utilize the zipfile.extractall() method without path validation. This implementation is vulnerable to ZipSlip attacks, allowing a maliciously crafted .pptx or .docx file to use path traversal sequences (e.g., ../../) to write files outside of the target directory, potentially leading to system compromise.
[COMMAND_EXECUTION]: The skill executes external binaries such as soffice (LibreOffice), pdftoppm (Poppler), and git via subprocess.run(). While these are used for intended functions like document conversion and comparison, they operate on user-supplied or agent-unpacked files. The lack of argument delimiters (e.g., using -- before filenames) may allow for option injection if filenames are maliciously crafted.
[DATA_EXFILTRATION]: The scripts/html2pptx.js utility uses the Playwright headless browser to render HTML content for slide generation. This creates an attack surface where malicious HTML or JavaScript could attempt to access local files via file:// URIs or perform internal network requests (SSRF) that are subsequently rendered or processed by the agent.
[PROMPT_INJECTION]: The skill presents a significant indirect prompt injection surface as it processes untrusted data from PowerPoint presentations and HTML files. The instructions lack explicit boundary markers or sanitization guidelines to ensure the agent ignores instructions embedded within the content it analyzes.
Ingestion points: Presentation files processed by markitdown and unpack.py (referenced in SKILL.md); HTML slide templates processed by html2pptx.js.
Boundary markers: Absent. The agent is not instructed to distinguish between system instructions and untrusted slide content.
Capability inventory: System command execution, file system writes via python-pptx, and headless browser rendering.
Sanitization: While defusedxml is used for XML parsing, the skill lacks sanitization for ZIP archive extraction and general validation of ingested text content.

pptx