The Agent Skills Directory

[COMMAND_EXECUTION]: The test script tests/test_gen_from_template.py uses subprocess.run to execute the skill's internal utility scripts for validation purposes. These calls use explicit argument lists and target local paths, which is a standard and safe practice for testing CLI tools.- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided Word documents and JSON files. While this presents a theoretical surface for indirect prompt injection if the ingested content contains instructions intended for the agent, the skill itself does not perform unsafe prompt interpolation or expose high-privilege capabilities that would lead to exploitation.- [EXTERNAL_DOWNLOADS]: The documentation points to a public GitHub repository at github.com/tjxj/z-skills for the source code, which matches the author's identity. No unauthorized or hidden remote downloads were detected.- [SAFE]: The core logic of the skill relies on the standard python-docx library to manipulate document XML structures safely. No obfuscation, persistence mechanisms, or credential theft patterns were found.

z-docx-format-brush