The Agent Skills Directory

[DYNAMIC_EXECUTION]: Critical Zip Slip vulnerability identified in ooxml/scripts/unpack.py and ooxml/scripts/validation/redlining.py. These scripts utilize zipfile.extractall() on user-provided PowerPoint files without path validation or extraction filters. This enables directory traversal attacks, allowing a malicious PPTX archive to overwrite arbitrary files on the local filesystem (e.g., shell profiles or other skill scripts).
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted text and XML content from user-supplied presentations without sufficient boundary markers or sanitization, creating a surface for indirect prompt injection attacks.
Ingestion points: Presentation text extracted via scripts/inventory.py and raw XML data extracted via ooxml/scripts/unpack.py enter the agent context.
Boundary markers: Absent; document content is presented to the agent without instructions or delimiters to distinguish user data from agent instructions.
Capability inventory: Subprocess execution of external binaries (soffice, pdftoppm) in scripts/thumbnail.py and ooxml/scripts/pack.py, and arbitrary file system writes via scripts/replace.py.
Sanitization: Absent; presentation content is interpolated into agent prompts without filtering or validation.
[DYNAMIC_EXECUTION]: Use of insecure XML parsing in ooxml/scripts/validation/redlining.py and ooxml/scripts/validation/base.py. These modules use standard lxml.etree and xml.etree.ElementTree without explicitly disabling entity resolution, potentially exposing the environment to XML entity expansion (Denial of Service) attacks.
[COMMAND_EXECUTION]: The skill frequently executes external CLI tools (soffice, pdftoppm, git) using subprocess.run. While these are part of the core functionality, they represent a significant attack surface if induced to process maliciously crafted filenames or parameters provided in untrusted documents.

pptx