docx
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
subprocess.runto invoke system binaries such assofficefor document validation andgitfor change comparison. These calls are executed using argument lists rather than shell strings, which prevents command injection risks. - [EXTERNAL_DOWNLOADS]: The documentation guides users to install the
docxlibrary from the npm registry, a standard and well-known dependency for Node.js-based document generation. - [SAFE]: The skill processes external document data (ingestion points located in
scripts/unpack.pyandscripts/ooxml/scripts/unpack.py). While document text is not wrapped in explicit boundary markers, the vulnerability surface is secured. Capabilities are restricted to local file manipulation and designated validation tools. Sanitization is consistently applied through secure XML parsing usingdefusedxmland directory-bound checks during the extraction of ZIP archive contents.
Audit Metadata