The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes local utility scripts and the LibreOffice binary for formula recalculation using subprocess.run. These invocations use list-based arguments rather than shell execution, mitigating command-injection risks.
[SAFE]: No malicious logic, unauthorized data access, or obfuscation was detected. The scripts/xlsx_unpack.py utility includes specific logic to prevent path-traversal (Zip Slip) attacks during archive extraction, reflecting a security-conscious design.
[PROMPT_INJECTION]: As a tool for processing external spreadsheet files, the skill has an inherent surface for indirect prompt injection. It manages this risk through structured data processing and a multi-tier validation architecture (static and dynamic checks) to verify output safety.
Ingestion points: scripts/xlsx_reader.py (via pandas) and scripts/xlsx_unpack.py (via zip extraction).
Boundary markers: Instructions define specific task paths (READ, CREATE, EDIT) with distinct reference guides.
Capability inventory: Reading and writing local files; executing local Python scripts and LibreOffice binaries.
Sanitization: scripts/xlsx_unpack.py validates that extracted file paths reside within the intended target directory.

minimax-xlsx