The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to unpack and analyze .docx files, which involves reading and processing their XML content. This creates a surface for indirect prompt injection where malicious instructions embedded in a document could influence the agent's behavior during analysis.
Ingestion points: ooxml/scripts/unpack.py, scripts/document.py, and scripts/utilities.py all ingest and parse XML content from external documents (e.g., document.xml).
Boundary markers: While the skill documentation suggests using pandoc to convert documents to Markdown for text extraction to help preserve structure, the primary editing workflows use raw XML access.
Capability inventory: The skill can execute shell commands (soffice, git), perform file system operations, and generate/manipulate document files.
Sanitization: The skill uses the defusedxml library for its core editing functionality, which effectively mitigates common XML vulnerabilities.
[DATA_EXFILTRATION]: There is a potential data access risk in the validation scripts (ooxml/scripts/validation/base.py, ooxml/scripts/validation/docx.py) which use the standard lxml library for schema validation.
The use of lxml.etree.parse without explicitly disabling external entity resolution could potentially allow a maliciously crafted document to trigger an XML External Entity (XXE) attack, enabling the reading of local sensitive files if the validation process is run on untrusted content.
[COMMAND_EXECUTION]: The skill executes external binaries (soffice for document conversion/validation and git for diffing) via subprocess.run in ooxml/scripts/pack.py and ooxml/scripts/validation/redlining.py.
These calls are implemented using argument lists rather than shell strings, which mitigates the risk of command injection through metacharacters or argument splitting. The parameters are mostly constrained by system-generated paths or hardcoded configuration values.

docx