docx
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes instructions for installing standard technical dependencies from official repositories, including pandoc, the docx NPM package, LibreOffice, and the defusedxml Python library.
- [COMMAND_EXECUTION]: Python scripts within the skill utilize subprocess calls to execute local system tools, specifically 'soffice' (LibreOffice) for document integrity validation and 'git' for generating content differences. These calls are implemented using safe argument-list passing instead of shell strings.
- [COMMAND_EXECUTION]: Instructions provide the agent with bash patterns for using established document processing tools like 'pandoc' for structure analysis and 'pdftoppm' for image conversion.
- [SAFE]: All XML manipulation is performed using the 'defusedxml' library, which provides robust protection against XML-specific vulnerabilities such as External Entity (XXE) injection and Billion Laughs expansion attacks.
- [SAFE]: The skill documentation includes an 'agent steering' pattern that requires the agent to read entire technical reference files without chunking, ensuring the agent maintains the full technical context required for complex OOXML editing tasks.
Audit Metadata