The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources (.xlsx and .csv files), which presents a potential surface for indirect prompt injection attacks.
Ingestion points: Data enters the agent's context through xlsx_read.py, xlsx_edit.py, xlsx_restructure.py, and xlsx_to_csv.py when sheets are dumped or inspected.
Boundary markers: The instructions do not define clear delimiters or system-level warnings to distinguish between spreadsheet data and potential instructions, increasing the risk that the agent may follow commands hidden within cells.
Capability inventory: The skill possesses significant capabilities, including local file system write access (wb.save) and the ability to trigger external process execution via xlsx_recalc.py.
Sanitization: While the scripts perform basic type inference (e.g., converting strings to numbers or dates), they do not sanitize or filter the text content of cells for instructional patterns.
[COMMAND_EXECUTION]: The script scripts/xlsx_recalc.py utilizes subprocess.run to invoke the soffice (LibreOffice) binary.
This is used for the legitimate purpose of headless formula recalculation, which is required because the openpyxl library does not evaluate Excel formulas natively.
The implementation includes a security best practice by setting the HOME environment variable to a temporary directory to isolate the application's configuration and cache.
The skill also uses subprocess.run in tests/test_xlsx_skill.py to execute its own helper scripts for verification purposes.

xlsx