The Agent Skills Directory

[DATA_EXFILTRATION]: Unsafe XML parsing in validation scripts. The ooxml/scripts/validation/base.py, ooxml/scripts/validation/pptx.py, and ooxml/scripts/validation/redlining.py scripts use lxml.etree.parse or xml.etree.ElementTree.parse to process XML files from the PowerPoint package without disabling external entity resolution or DTD loading. This creates a vulnerability to XML External Entity (XXE) attacks, which could be exploited by a malicious PowerPoint file to read local files from the host system.
[COMMAND_EXECUTION]: Unsafe ZIP extraction in ooxml/scripts/unpack.py. The script uses ZipFile.extractall() on input office files without validating the filenames within the archive. This makes the script vulnerable to path traversal (ZipSlip) attacks, where a malicious PowerPoint file could contain entries like ../../filename to overwrite sensitive files outside the intended output directory.
[COMMAND_EXECUTION]: Broad command execution capabilities through shell utilities. Multiple scripts (thumbnail.py, pack.py, validate.py, redlining.py) use subprocess.run to execute external binaries including soffice, pdftoppm, and git. While currently implemented using list-based arguments, this represents a significant capability surface that could be abused if an attacker can manipulate the file paths or options passed to these commands.
[COMMAND_EXECUTION]: Browser-based code execution via Playwright. The scripts/html2pptx.js script launches a headless Chromium browser and uses page.evaluate to execute logic. This environment executes any JavaScript contained within the HTML slide files, which are generated based on potentially untrusted input content.
[PROMPT_INJECTION]: Indirect prompt injection attack surface identified.
Ingestion points: Extracted slide text and metadata from .pptx files ingested via markitdown and inventory.py (referenced in SKILL.md).
Boundary markers: Absent. The extracted content is presented to the agent without clear delimiters or instructions to ignore embedded commands.
Capability inventory: Subprocess command execution (soffice, git), local file system read/write, and browser-based code execution (Playwright).
Sanitization: Inconsistent. While defusedxml is used in some scripts, other validation scripts use unsafe XML parsing methods.

pptx