The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill utilizes runtime compilation and library injection to modify external process behavior.
The script scripts/office/soffice.py contains a hardcoded C source (_SHIM_SOURCE) designed to shim network system calls.
It compiles this source at runtime using gcc and employs the LD_PRELOAD environment variable to inject the resulting library into the soffice (LibreOffice) process.
[COMMAND_EXECUTION]: The skill uses the shell to run several system utilities that could be abused if arguments are improperly handled.
Scripts such as scripts/accept_changes.py, scripts/office/validators/redlining.py, and scripts/office/soffice.py invoke subprocess.run() to execute soffice, git, and gcc.
[INDIRECT_PROMPT_INJECTION]: The skill exposes the agent to untrusted content from Word documents without sufficient isolation, creating a potential attack surface.
Ingestion points: Document content is read into the context via scripts/office/unpack.py and text extraction via pandoc as described in SKILL.md.
Boundary markers: The instructions do not specify the use of delimiters or commands to ignore instructions found within document text.
Capability inventory: The skill has powerful system capabilities including shell execution, filesystem writes, and process injection.
Sanitization: While technical XML sanitization is present, there is no natural language filtering for instructions extracted from documents.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: SKILL.md specifies the installation of external packages from public registries.
It instructs the agent to install docx via NPM and python-docx via Pip, which are then used during document generation and validation tasks.
[METADATA_POISONING]: The skill contains deceptive licensing information.
The LICENSE.txt file claims copyright for Anthropic, PBC, which contradicts the actual author attribution (medy-gribkov).

docx