The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/fill_form.py script executes system utilities (textutil on macOS and libreoffice or soffice as a fallback) to convert legacy .doc files to the .docx format. These operations are performed securely using argument lists in subprocess.run(), which prevents shell injection vulnerabilities even when handling user-provided file paths.
[EXTERNAL_DOWNLOADS]: The skill requires the python-docx library, a well-known and standard package for programmatically interacting with Microsoft Word documents. Installation instructions utilize standard package management via python3 -m pip.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a processing surface for indirect prompt injection because it ingests and parses content from user-provided Word templates. This is an inherent risk of the skill's primary purpose.
Ingestion points: The scripts/fill_form.py script reads template files via python-docx to identify table labels and paragraph text.
Boundary markers: Detected fields are presented to the agent as a list and JSON structure. No explicit instructions are given to the agent to disregard instructions potentially embedded within the document text.
Capability inventory: The skill has the capability to write documents to the local filesystem using the doc.save() method.
Sanitization: The script performs basic whitespace normalization on label text but does not implement sanitization or escaping of document content.

lov-fill-form