The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions contain authoritative directives (e.g., "MANDATORY", "NEVER set any range limits") that override default agent behavior for reading documentation files (docx-js.md, ooxml.md). Additionally, the skill creates an indirect prompt injection surface by ingesting content from untrusted external .docx files.
Ingestion points: Text extraction and raw XML access instructions in SKILL.md.
Boundary markers: Absent; there are no explicit instructions to ignore embedded commands within the extracted document content.
Capability inventory: The skill utilizes subprocess calls to system utilities and performs extensive file system operations.
Sanitization: Employs defusedxml for XML parsing (scripts/document.py, ooxml/scripts/pack.py) to prevent XML-based attacks, though it does not sanitize natural language content.
[COMMAND_EXECUTION]: Python scripts in the skill (ooxml/scripts/pack.py, ooxml/scripts/validation/redlining.py) use subprocess.run to execute system commands such as 'soffice' (LibreOffice) and 'git'. While these are associated with the skill's primary document processing purpose, they involve interaction with the underlying system shell and represent a potential attack surface if file paths were manipulated. The setup instructions also include 'sudo' commands for installing system dependencies.
[EXTERNAL_DOWNLOADS]: The skill documentation (SKILL.md) instructs the user to download and install external packages and tools including pandoc, libreoffice, and the 'docx' npm package. These are established and well-known document processing technologies.

docx