The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-provided .pptx files, which serves as a significant attack surface for indirect injections.
Ingestion points: Presentation files are read and processed in scripts/inventory.py and ooxml/scripts/unpack.py.
Boundary markers: Absent; the skill extracts text directly into the agent's context without clear delimiters or instructions to ignore embedded commands.
Capability inventory: The skill possesses high-privilege capabilities including file system writes, execution of system binaries via subprocess, and full browser rendering via Playwright.
Sanitization: While defusedxml is used in some components, other parts of the skill rely on standard libraries that lack protection against malicious content.
[COMMAND_EXECUTION]: The skill relies on executing external system binaries and contains unsafe file handling logic.
Vulnerability: Uses zipfile.extractall() in ooxml/scripts/unpack.py, ooxml/scripts/validation/docx.py, and ooxml/scripts/validation/redlining.py. This method is vulnerable to ZipSlip (path traversal), which allows a specially crafted .pptx file to overwrite arbitrary files on the host system.
Vulnerability: System binaries such as soffice (LibreOffice), pdftoppm (Poppler), and git are invoked via subprocess.run in scripts/thumbnail.py and ooxml/scripts/pack.py. Executing these utilities on untrusted user files increases the risk of exploiting vulnerabilities in those external tools.
[DYNAMIC_EXECUTION]: The skill uses complex environments to process and render data, introducing additional risks.
Vulnerability: Uses a headless Chromium instance via Playwright in scripts/html2pptx.js to render HTML slides. Browser-based rendering of untrusted content is a known high-risk activity.
Vulnerability: Uses the standard xml.etree.ElementTree library in ooxml/scripts/validation/redlining.py to parse document XML. This library is vulnerable to XML External Entity (XXE) attacks, which can lead to local file disclosure or server-side request forgery (SSRF).

pptx