The Agent Skills Directory

[COMMAND_EXECUTION]: The script ooxml/scripts/unpack.py uses zipfile.extractall() on untrusted input files without validating member paths. This facilitates Path Traversal (ZipSlip), allowing a malicious document to overwrite arbitrary files on the local filesystem.
[DATA_EXFILTRATION]: Multiple validation scripts (ooxml/scripts/validation/base.py, docx.py, pptx.py) use lxml.etree.parse to process XML content from untrusted documents without disabling entity resolution. This creates an XML External Entity (XXE) vulnerability, which could be exploited to read sensitive files from the environment.
[PROMPT_INJECTION]: Instructions in SKILL.md attempt to bypass agent security policies by explicitly commanding the agent to ignore tool usage constraints (e.g., "NEVER set any range limits") when reading large documentation files.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it ingests and processes untrusted .docx files. (1) Ingestion points: Document content is processed in ooxml/scripts/unpack.py and scripts/document.py. (2) Boundary markers: Not present; no instructions are provided to the agent to disregard commands or instructions found within documents. (3) Capability inventory: Shell command execution via subprocess.run for soffice and git is present in the skill scripts. (4) Sanitization: Inconsistent implementation; while some modules use defusedxml, others rely on vulnerable lxml defaults.
[COMMAND_EXECUTION]: Core functionality involves executing subprocess.run to call system utilities such as pandoc, soffice (LibreOffice), and git for document conversion and verification.
[EXTERNAL_DOWNLOADS]: The documentation references external dependencies that the user is instructed to install via system package managers or npm, including pandoc, docx, libreoffice, poppler-utils, and defusedxml.

docx