The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/office/soffice.py contains hardcoded C source code (_SHIM_SOURCE) that is written to a temporary file and compiled at runtime using gcc. The resulting shared object is then injected into subprocesses via the LD_PRELOAD environment variable to intercept and shim system socket calls (socket, listen, accept, close). While this is used to enable LibreOffice functionality in restricted environments, it represents a significant dynamic execution pattern.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect prompt injection as it is specifically designed to read and process external Word documents.
Ingestion points: Document content enters the agent's context through pandoc text extraction and raw XML unpacking (referenced in SKILL.md).
Boundary markers: The instructions do not define clear delimiters or warnings for the agent when processing extracted document text.
Capability inventory: The skill has the ability to execute shell commands (via soffice, pdftoppm, git, and gcc) and write files back to the system (referenced in scripts/accept_changes.py, scripts/render_docx.py, and scripts/office/pack.py).
Sanitization: The skill correctly utilizes defusedxml to mitigate standard XML-based attacks during parsing.
[COMMAND_EXECUTION]: Several components rely on executing system binaries through subprocess.run. This includes soffice for document conversion, pdftoppm for rendering images, git for generating document diffs in RedliningValidator, and gcc for compiling the socket shim. This creates a risk if the agent passes unvalidated user-supplied paths to these tools.
[EXTERNAL_DOWNLOADS]: The instructions in SKILL.md direct the user to install the docx library globally using npm install -g docx. While this is a standard dependency for the skill's JavaScript functionality, it involves downloading and installing third-party code from the public npm registry.

docx