docx
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted document content, establishing a vulnerability surface for indirect prompt injection attacks. Ingestion points: XML content is read from documents in ooxml/scripts/unpack.py and scripts/document.py. Boundary markers: Absent; there are no explicit delimiters or instructions to the agent to disregard commands found within the document XML. Capability inventory: The skill can execute local system tools (soffice and git) and perform file system read/write operations. Sanitization: Employs the defusedxml library across scripts to prevent XML External Entity (XXE) attacks and performs HTML escaping on author metadata in scripts/document.py.
- [COMMAND_EXECUTION]: Executes system commands to facilitate document validation and diffing operations. Evidence: Calls to soffice in ooxml/scripts/pack.py and git in ooxml/scripts/validation/redlining.py. These subprocess calls use argument lists rather than shell strings, mitigating shell injection risks.
- [EXTERNAL_DOWNLOADS]: References software and libraries for installation from well-known registries. Evidence: Instructions in SKILL.md list pandoc (apt), docx (npm), and defusedxml (pip) as required dependencies.
Audit Metadata