The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently executes external system commands using the subprocess module to perform core tasks. Evidence: scripts/thumbnail.py runs pdftoppm to convert PDF slides into images; scripts/office/validators/redlining.py uses git diff to perform comparisons; scripts/office/soffice.py executes the system compiler (gcc) and LibreOffice (soffice).
[REMOTE_CODE_EXECUTION]: The script scripts/office/soffice.py employs a dynamic code generation and injection pattern. It writes an embedded C source string to a temporary file (lo_socket_shim.c) and compiles it into a shared library using gcc at runtime. It then uses the LD_PRELOAD environment variable to inject this library into the soffice process to modify its behavior regarding Unix sockets. While intended for environment compatibility, this mechanism bypasses standard execution constraints and represents a significant security capability.
[EXTERNAL_DOWNLOADS]: Documentation in SKILL.md and pptxgenjs.md guides users to install multiple external packages from public package registries. Requirements include pptxgenjs, markitdown[pptx], react-icons, react, react-dom, and sharp.
[PROMPT_INJECTION]: The skill is designed to ingest and parse untrusted content from PowerPoint files, creating a surface for indirect prompt injection. Ingestion points: Presentation content is extracted via markitdown and raw XML unpacking (scripts/office/unpack.py). Boundary markers: Extracted content is processed without clear delimiters or instructions to the AI to ignore embedded commands. Capability inventory: The skill has broad capabilities, including arbitrary file writes, command execution, and runtime code compilation, which increases the potential impact. Sanitization: There is no evidence of filtering or sanitizing the text extracted from presentations before it enters the agent context.

pptx