docx
Warn
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes various system binaries including soffice, pandoc, and pdftoppm through subprocess calls. It also executes gcc at runtime to compile a shared networking shim from source.
- [EXTERNAL_DOWNLOADS]: Documentation instructs the agent to install the docx package globally via the npm registry.
- [REMOTE_CODE_EXECUTION]: The script scripts/office/soffice.py performs dynamic execution by generating a C source file, compiling it into a shared library, and using the LD_PRELOAD environment variable to inject it into the office process for networking behavior modification.
- [PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection through the ingestion of external document files. 1. Ingestion points: Document content enters the context via pandoc extraction and XML unpacking. 2. Boundary markers: The instructions do not provide explicit delimiters for document content. 3. Capability inventory: High-risk capabilities include shell command execution, runtime C compilation, and library injection. 4. Sanitization: Uses defusedxml for secure XML parsing, but instructions also support direct string replacement for editing.
Audit Metadata