The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes several external binaries via subprocess.run to perform legitimate document processing tasks.
ooxml/scripts/pack.py and scripts/thumbnail.py call soffice (LibreOffice) to validate presentations and convert them to PDF.
scripts/thumbnail.py calls pdftoppm (Poppler) to generate image thumbnails from slides.
ooxml/scripts/validation/redlining.py calls git diff to compare text changes in document XML files.
These subprocess calls use list-based arguments, which is a secure practice that mitigates shell injection, but the tools themselves remain an attack surface if they contain vulnerabilities exploitable by malicious input files.
ooxml/scripts/unpack.py uses ZipFile.extractall(), which is a known security risk for path traversal (Zip Slip) if an extracted archive contains malicious filenames with parent directory references (e.g., ../../).
[PROMPT_INJECTION]: The skill has a significant surface area for Indirect Prompt Injection because it processes complex, untrusted data formats.
Ingestion points: Untrusted data enters the agent context through the parsing of .pptx files in inventory.py and the rendering of HTML content in html2pptx.js via Playwright.
Boundary markers: The skill does not employ explicit boundary markers or instructions to ignore embedded commands in the slide content or HTML data it processes.
Capability inventory: The skill's environment includes capabilities for filesystem writes, subprocess execution, and running a full browser engine, which could be leveraged if an indirect injection is successful.
Sanitization: There is no evidence of sanitization or escaping of the text extracted from presentations before it is presented to the agent or interpolated into other workflows.

pptx