The Agent Skills Directory

[DATA_EXFILTRATION]: Internal validation scripts in the skill use XML parsers that are vulnerable to XML External Entity (XXE) attacks by default.
Evidence in ooxml/scripts/validation/base.py (uses lxml.etree) and ooxml/scripts/validation/redlining.py (uses xml.etree.ElementTree).
These parsers can be exploited by maliciously crafted document files to read local system files or perform server-side request forgery (SSRF) during the validation phase.
While the skill's main editing utilities correctly use the defusedxml library, the inclusion of unsafe parsers in the validation logic creates an exposure risk.
[PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it is designed to ingest and process data from untrusted Word documents.
Ingestion points: Document XML files are unpacked and their text content is read into the agent's context in scripts/document.py and scripts/utilities.py.
Boundary markers: The instructions do not define delimiters or provide warnings for the agent to ignore instructions that might be embedded within the document text.
Capability inventory: The skill has the capability to execute shell commands (git, soffice) and perform file system writes (doc.save()).
Sanitization: The skill uses the defusedxml library in its core manipulation scripts to mitigate XXE risks during primary ingestion.
[COMMAND_EXECUTION]: The skill uses subprocess.run to execute external commands for document diffing and validation.
Evidence in ooxml/scripts/pack.py (calls soffice) and ooxml/scripts/validation/redlining.py (calls git).
These subprocess calls use list-based arguments and target local files, which minimizes the risk of arbitrary command injection.
[EXTERNAL_DOWNLOADS]: The skill's documentation identifies several standard third-party tools and libraries required for operation.
These include system packages like pandoc, LibreOffice, and poppler-utils.
Referenced libraries include the docx Node.js package and the defusedxml Python package.

docx