docx
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Word documents and extracted text but lacks clear boundary markers or instructions for the agent to disregard natural language commands found within the documents.
- Ingestion points: Untrusted content is ingested through XML parsing in 'scripts/document.py' and natural language text extracted via 'pandoc' (as described in 'SKILL.md').
- Boundary markers: No instructions are provided to wrap extracted content in delimiters or warn the agent about potential instructions embedded in documents.
- Capability inventory: The skill possesses extensive capabilities, including file system write access and the ability to execute shell commands ('soffice' for conversion and 'git' for diffing) via 'subprocess.run' in 'ooxml/scripts/pack.py' and 'ooxml/scripts/validation/redlining.py'.
- Sanitization: The skill correctly uses 'defusedxml' to mitigate structural XML vulnerabilities (like XXE) during the unpacking and editing process, but it does not perform content-level sanitization or provide safeguards against natural language instruction injection.
Audit Metadata