The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/prepare.py is vulnerable to a ZipSlip (path traversal) attack. It uses zipfile.extractall() to unpack PPTX files without validating that the filenames within the archive do not contain path traversal sequences (e.g., ../../). A malicious PPTX file could overwrite sensitive files outside the intended workspace.
[DATA_EXFILTRATION]: The script scripts/prepare.py uses the xml.etree.ElementTree.parse() function to process XML data from the PPTX. This parser is insecure against XML External Entity (XXE) attacks. An attacker could craft a PPTX file with malicious XML entities to read local files or perform Server-Side Request Forgery (SSRF).
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection. It extracts text and metadata from untrusted PPTX files and injects them into a sub-agent's prompt in references/sub_agent_prompt.md without adequate sanitization or boundary protection.
Ingestion points: Untrusted text and layout information are extracted from slide XML and relations in scripts/prepare.py.
Boundary markers: The sub-agent prompt uses basic markdown structure but lacks distinct delimiters or explicit instructions to treat the slide content as untrusted data.
Capability inventory: The system can execute shell commands through the provided Python scripts and has access to local files and external binaries (soffice, pdftoppm).
Sanitization: No sanitization, filtering, or escaping is performed on the extracted slide content before it is interpolated into the prompt.
[COMMAND_EXECUTION]: The skill invokes external binaries soffice and pdftoppm using subprocess.run(). While it correctly uses argument lists, the overall security of these operations is undermined by the ZipSlip vulnerability in the file preparation stage.

pptx-to-md