skills/szweibel/claude-skills/docx/Gen Agent Trust Hub

docx

Pass

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses system binaries for document processing tasks.
  • ooxml/scripts/pack.py uses subprocess.run to call soffice (LibreOffice) for document validation.
  • ooxml/scripts/validation/redlining.py uses subprocess.run to call git diff for comparing document changes.
  • These calls are targeted at specific, well-known binaries with arguments controlled by the script logic.
  • [EXTERNAL_DOWNLOADS]: The documentation guides the installation of standard tools and libraries.
  • It instructs the user/agent to install pandoc, libreoffice, and poppler-utils via system package managers.
  • It lists official package registry dependencies like the docx Node.js library and the defusedxml Python library.
  • [DATA_EXFILTRATION]: The skill implements strong protections against XML-based data exposure.
  • Multiple components (document.py, unpack.py, pack.py, utilities.py) use defusedxml to parse XML files, preventing XML External Entity (XXE) attacks which are a common risk in document processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 16, 2026, 07:05 AM
Security Audit — agent-trust-hub — docx