The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external utilities via the Python subprocess module to perform document validation and comparison. Specifically, it uses soffice (LibreOffice) for headless document conversion during validation and git for calculating precise differences in Word content. These commands use static arguments and validated paths to prevent injection risks.
[EXTERNAL_DOWNLOADS]: The documentation specifies several standard system-level dependencies for document processing, including pandoc, libreoffice, and poppler-utils. These are to be installed by the user via official package managers (apt, npm, pip) and are necessary for the skill's intended functionality.
[SAFE]: The archive extraction logic in ooxml/scripts/unpack.py includes comprehensive security checks. It implements a _is_safe_destination check to prevent Zip Slip (path traversal) vulnerabilities and enforces strict limits on member size, total uncompressed size, and compression ratios to mitigate Zip Bomb (resource exhaustion) attacks.
[SAFE]: All XML parsing across the skill's Python library and validation scripts utilizes the defusedxml library or hardened lxml configurations. These measures explicitly disable entity resolution and network access, effectively preventing XML External Entity (XXE) and billion laughs attacks.

docx-official