The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/office/soffice.py contains a static C source code block that it writes to a temporary file and compiles at runtime using gcc. The resulting shared object is then loaded into the environment using LD_PRELOAD. While this is intended as a shim to support LibreOffice in sandboxed environments by redirecting socket calls, it constitutes sophisticated runtime code generation and injection.
[COMMAND_EXECUTION]: The skill frequently uses subprocess.run() to execute system binaries across several scripts:
scripts/office/soffice.py executes gcc for runtime compilation.
scripts/thumbnail.py executes soffice (LibreOffice) and pdftoppm (Poppler) for document conversion and image processing.
scripts/office/validators/redlining.py executes git diff for version comparison.
[METADATA_POISONING]: The description field in the SKILL.md frontmatter is set to "QUERY LENGTH LIMIT EXCEEDED. MAX ALLOWED QUERY : 500 CHARS". This is deceptive as it mimics a system error message within the skill metadata.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied Office documents, creating a surface for indirect prompt injection.
Ingestion points: Untrusted content enters the context via scripts/office/unpack.py (XML extraction) and scripts/thumbnail.py (visual analysis).
Boundary markers: The scripts utilize defusedxml to mitigate XML-specific attacks like XXE, but there are no textual boundaries or instructions provided to the agent to disregard natural language commands that might be found within the extracted slide content.
Capability inventory: The skill allows for significant system interactions including filesystem writes and the execution of powerful command-line utilities.
Sanitization: Sanitization is handled at the XML parsing layer (defusedxml), but content extracted for the agent's natural language processing lacks specific filtering or sanitization.

pptx