The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The script presentation/scripts/libreoffice.mjs contains logic to detect and use sudo to execute apt-get install for system dependencies such as libreoffice-impress, libreoffice-writer, and poppler-utils. This is an attempt to gain root privileges to modify the system's installed packages.
[COMMAND_EXECUTION]: Multiple scripts within the skill (docx/scripts/build_reference.py, pdf/scripts/analyze_pdf.py, presentation/scripts/libreoffice.mjs, and others) use subprocess.run or spawnSync to execute system commands including pandoc, soffice, pdftocairo, ffmpeg, and apt-get. These commands are used to convert documents and analyze visual styles.
[EXTERNAL_DOWNLOADS]: The skill uses docx/scripts/ensure_pandoc.py and pdf/scripts/ensure_pandoc.py to download portable pandoc binaries from its official GitHub releases page (https://github.com/jgm/pandoc/releases). These downloads are performed using the urllib.request module.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-uploaded documents (PPTX, DOCX, PDF) and images to extract visual styles and content structures. This information is then used to generate new prompts and templates, which could lead to the agent following malicious instructions embedded in the source files.
Ingestion points: User-provided files processed by render-document.mjs, render-pages.mjs, and the analysis scripts in the docx, pdf, and illustration directories.
Boundary markers: The instructions do not include explicit delimiters or warnings to ignore instructions that may be embedded in the ingested documents.
Capability inventory: The skill has the ability to write to the file system, execute system commands via subprocesses, and access the network for dependency downloads.
Sanitization: The scripts use structured parsing (e.g., pymupdf for PDFs and xml.etree.ElementTree for DOCX) to extract specific metrics, which provides some protection against direct text injection but does not fully eliminate the risk of the agent interpreting embedded malicious content.

extract-template