The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script "scripts/office/soffice.py" contains embedded C source code that is written to a temporary file and compiled at runtime using "gcc". The resulting shared library is loaded into the LibreOffice process environment using the "LD_PRELOAD" environment variable to shim socket operations. This is a high-privilege technique used to ensure document conversion works in restricted environments.
[DYNAMIC_EXECUTION]: In "scripts/accept_changes.py", the skill dynamically generates a LibreOffice Basic macro and writes it to a specific configuration path ("/tmp/libreoffice_docx_profile/user/basic/Standard/Module1.xba") to automate the acceptance of tracked changes via the command line.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Word documents provided by the user. By converting these documents to markdown or rendering them to images for AI analysis, it creates an attack surface where instructions embedded in a document could attempt to influence the agent's behavior.
Ingestion points: Reads and extracts content from ".docx" files using "pandoc" and "pdftoppm" (as documented in "SKILL.md").
Boundary markers: Absent; content is extracted and processed without explicit delimiters or instructions to ignore embedded commands.
Capability inventory: The skill can execute shell commands, compile code, and write to the file system across multiple scripts.
Sanitization: Employs "defusedxml" to prevent XML-based attacks during parsing but does not sanitize text content against prompt injection patterns.
[COMMAND_EXECUTION]: The skill makes extensive use of the "subprocess.run" method to invoke external binaries including "soffice", "pandoc", "pdftoppm", "gcc", and "git". These powerful system-level capabilities are required for the documented document processing workflows but increase the potential risk if the skill were compromised.

docx