The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Runtime code compilation and process injection. The script scripts/office/soffice.py writes a C source string (_SHIM_SOURCE) to a temporary file, compiles it into a shared library using gcc, and then sets the LD_PRELOAD environment variable to inject this library into the soffice process. This is designed to shim socket calls to bypass AF_UNIX restrictions.
[REMOTE_CODE_EXECUTION]: Dynamic macro generation. The script scripts/accept_changes.py dynamically creates a LibreOffice Basic macro (ACCEPT_CHANGES_MACRO) and writes it to a temporary LibreOffice user profile before execution to automate document processing.
[COMMAND_EXECUTION]: Execution of system binaries. Multiple scripts utilize subprocess.run to execute external tools, including gcc for compilation, soffice for document conversion, git for generating diffs during validation, and pdftoppm for image extraction.
[EXTERNAL_DOWNLOADS]: External software and package dependencies. SKILL.md identifies several system-level dependencies including pandoc, LibreOffice, and Poppler. It also instructs users to perform a global installation of the docx Node.js package via npm install -g docx.
[PROMPT_INJECTION]: Indirect prompt injection vulnerability surface (Category 8).
Ingestion points: Untrusted data enters the agent context through .docx files processed by scripts/office/unpack.py and pandoc (via SKILL.md instructions).
Boundary markers: Absent. The skill does not implement specific delimiters or "ignore embedded instructions" warnings for the extracted document content.
Capability inventory: The skill possesses powerful local capabilities, including arbitrary command execution (via subprocess.run in soffice.py, pack.py, and redlining.py) and file system writes across various scripts.
Sanitization: The skill effectively mitigates XML-level attacks (such as XXE) by using the defusedxml library for all XML parsing tasks, but lacks sanitization for the resulting natural language content.

docx