The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run and spawnSync to execute internal utility scripts and bundled binaries (such as heif-convert and JxrDecApp) for image format conversion and slide rendering. These operations are scoped to the skill's package and the task workspace, with no evidence of unauthorized external execution.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data in the form of PowerPoint (PPTX) files and image assets, creating a surface for indirect prompt injection.
Ingestion points: Loads and parses user-supplied PPTX files for template analysis and editing in inspect_template_deck.mjs and materialize_literal_chart_workbooks.py.
Boundary markers: Not present; the agent processes the structural and textual data of the ingested files directly.
Capability inventory: Extensive file system access (read/write) and subprocess execution capabilities are utilized across the skill's processing scripts.
Sanitization: XML parsers (lxml, expat) are configured to disable DTD and external entity resolution, protecting against XXE attacks. Path validation logic is employed to ensure file operations remain within the assigned task workspace.

paper-fig