The Agent Skills Directory

[DYNAMIC_EXECUTION]: scripts/soffice.py generates C source code at runtime, compiles it using gcc, and injects the resulting shared library into the soffice process using LD_PRELOAD to handle socket restrictions.
[PRIVILEGE_ESCALATION]: The skill attempts to write font files to /usr/local/share/fonts/design-export-repair, which is a system-wide directory. It also utilizes LD_PRELOAD process injection to modify the environment and execution flow of the LibreOffice process.
[UNVERIFIABLE_DEPENDENCIES]: scripts/fonts.py fetches external font assets from a remote repository on GitHub (google/fonts). While these are fetched from a well-known service, they are external assets used at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted PPTX, PDF, and HTML files, which are then processed by complex rendering engines (LibreOffice and Playwright), creating a significant attack surface for malicious document content.
Ingestion points: scripts/unpack.py identifies and extracts input files from ZIP archives or direct uploads.
Boundary markers: The skill does not implement explicit boundary markers or warnings for content embedded within processed documents.
Capability inventory: The skill possesses capabilities for subprocess execution (gcc, soffice, fc-cache), file writes to system paths, and headless browser rendering via Playwright.
Sanitization: The skill relies on standard third-party libraries (python-pptx, pymupdf) for parsing and does not implement additional sanitization of the document data.

design-export-repair