The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/office/soffice.py contains logic to write C source code to a temporary file, compile it into a shared object (.so) using gcc, and then inject that object into the soffice process execution using the LD_PRELOAD environment variable. This pattern is highly characteristic of process-injection attacks.
[COMMAND_EXECUTION]: Multiple scripts execute arbitrary system commands via subprocess.run, including scripts/office/soffice.py (which invokes gcc and soffice), scripts/accept_changes.py (which invokes soffice), and scripts/office/validators/redlining.py (which invokes git diff).
[PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection.
Ingestion points: Untrusted document data is ingested through scripts/office/unpack.py and scripts/office/validate.py.
Boundary markers: None. No delimiters or instructions to ignore embedded commands are present in the processing pipeline.
Capability inventory: The skill has significant capabilities including file writing and arbitrary command execution through soffice and gcc as defined in scripts/office/soffice.py.
Sanitization: The skill employs defusedxml for XML parsing, which provides protection against XML External Entity (XXE) attacks, but does not sanitize natural language content that may influence agent logic.

docx