The Agent Skills Directory

[PRIVILEGE_ESCALATION]: Instructions in SKILL.md suggest using sudo apt-get install to set up dependencies like pandoc, libreoffice, and poppler-utils. Commands involving sudo pose a security risk as they grant administrative privileges.
[PRIVILEGE_ESCALATION]: The scripts ooxml/scripts/unpack.py, ooxml/scripts/validation/redlining.py, and ooxml/scripts/validation/base.py use zipfile.ZipFile.extractall() without validating extracted file paths. This makes the skill vulnerable to 'Zip Slip' attacks, where a malicious Office document can use directory traversal (e.g., ../../) to overwrite sensitive files outside the intended workspace.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted document content, creating a surface for indirect prompt injection.
Ingestion points: Untrusted XML content from Office files is unpacked into the workspace by ooxml/scripts/unpack.py and read into the agent's context.
Boundary markers: Absent. There are no delimiters or instructions to ignore embedded commands when the agent reads the extracted data.
Capability inventory: Shell command execution via subprocess.run (invoking soffice and git) is used in ooxml/scripts/pack.py and ooxml/scripts/validation/redlining.py, and the skill has extensive file system write access.
Sanitization: Absent. Content is processed without filtering for potential malicious instructions.
[COMMAND_EXECUTION]: The skill invokes external binaries such as soffice and git via subprocess.run to perform document validation and version comparisons. While the use of list-based arguments reduces the risk of direct shell injection, these calls still represent execution of external system utilities triggered by document processing.
[EXTERNAL_DOWNLOADS]: The skill documentation suggests installing common third-party packages from official registries (e.g., npm install docx, pip install defusedxml). These are standard dependencies for the skill's primary functionality.

docx