The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains meta-instructions in SKILL.md that explicitly direct the AI agent to bypass standard tool usage constraints. Specifically, the instructions 'MANDATORY
READ ENTIRE FILE' and 'NEVER set any range limits' for the docx-js.md and ooxml.md documentation files attempt to override platform-level optimizations for reading large files. Additionally, the skill's primary function of processing untrusted .docx files and converting them to Markdown for agent review presents an indirect prompt injection surface. Evidence of this attack surface includes:
Ingestion points: External document content converted via pandoc or parsed directly from OOXML XML files (e.g., word/document.xml).
Boundary markers: Absent in instructions; the agent is simply told to 'Review the document and identify ALL changes needed'.
Capability inventory: The skill possesses capabilities to execute shell commands (soffice, git), write to the file system, and generate/execute Python and JavaScript scripts.
Sanitization: While the skill uses defusedxml to prevent XML-based attacks like XXE, it does not sanitize the natural language content of the documents before processing.
[COMMAND_EXECUTION]: The skill uses the Python subprocess.run module to execute system commands including soffice (for document validation/conversion) and git (for diffing changes). Although the skill implements path validation via safe_user_path and uses hardcoded command-line arguments to mitigate risks, the ability to execute external binaries remains a sensitive capability.

docx-official