The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill can automatically download the .NET SDK installation script from Microsoft's official domain (dot.net) if the environment is missing it. This is a trusted source and necessary for the creation route.
[DYNAMIC_EXECUTION]: The skill performs runtime compilation and execution of C# code using the .NET SDK. This is the primary mechanism for creating new Word documents and is handled within a controlled temporary directory.
[COMMAND_EXECUTION]: The skill uses shell commands and Python's subprocess.run to orchestrate tasks such as document conversion via Pandoc, .NET builds, and dependency checks. These calls are implemented using argument lists rather than shell strings, reducing the risk of command injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes external Markdown files and citation data (JSONL). While this represents an attack surface for indirect prompt injection, the skill uses structured parsing and established libraries (Pandoc, OpenXML SDK) to process this data, minimizing the risk of the agent interpreting data as instructions.
[OBFUSCATION]: The skill includes pre-compiled binary components including a validator executable and a Python shared library extension. These are legitimate parts of the skill's processing engine used for validating OOXML structures and performance-critical XML manipulation.

docx