The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Runtime compilation and dynamic library injection. The script scripts/office/soffice.py contains a hardcoded C source string that is written to a temporary location and compiled into a shared library using gcc. This library is then loaded into the soffice process memory using the LD_PRELOAD environment variable to intercept and modify system call behavior for socket handling. While this serves a utility purpose in restricted environments, it employs techniques common in advanced exploitation.
[COMMAND_EXECUTION]: Extensive use of shell commands for file processing. Multiple scripts utilize subprocess.run to execute external tools including soffice (document conversion), pdftoppm (image rendering), git (difference analysis), and gcc (compilation). These operations rely on the presence and integrity of system binaries.
[EXTERNAL_DOWNLOADS]: Instructions for installing third-party dependencies from public registries. The skill documentation recommends the installation of several Python packages (markitdown, Pillow) and global Node.js packages (pptxgenjs, react-icons, sharp, react, react-dom) from public package registries at setup time.
[PROMPT_INJECTION]: Vulnerability surface for indirect prompt injection from untrusted document content. The skill ingests, parses, and presents the content of user-provided .pptx files to the AI agent for analysis and visual inspection. Malicious text or metadata within these files could attempt to influence or override agent instructions during processing. Additionally, while defusedxml is used in most parsing routines, some scripts like scripts/office/validators/redlining.py utilize the standard xml.etree.ElementTree module which lacks built-in protections against XML External Entity (XXE) attacks.

pptx