The Agent Skills Directory

[SAFE]: The skill consistently uses the defusedxml library for parsing XML files, which effectively mitigates XML External Entity (XXE) and other XML-based attacks.
[COMMAND_EXECUTION]: Python scripts utilize subprocess.run to invoke soffice and git. These executions are limited to specific operations: soffice is used for headless document validation, and git is used for text-level differencing during redlining validation. These are legitimate uses within the skill's functional scope.
[EXTERNAL_DOWNLOADS]: The documentation suggests installing reputable industry tools such as pandoc, LibreOffice, and poppler-utils using standard system package managers.
[SAFE]: The document manipulation library properly escapes metadata such as author names and initials before inserting them into XML structures, preventing injection vulnerabilities.

docx