The Agent Skills Directory

COMMAND_EXECUTION (HIGH): The script ooxml/scripts/unpack.py is vulnerable to Path Traversal (Zip Slip). It uses zipfile.ZipFile(input_file).extractall(output_path) on a user-provided Office file. A maliciously crafted ZIP/OOXML file containing filenames with ../ sequences can write files to arbitrary locations on the agent's filesystem.
DATA_EXFILTRATION (MEDIUM): The validator in ooxml/scripts/validation/docx.py uses lxml.etree.parse() to process XML files extracted from user-supplied documents. By default, lxml is vulnerable to XML External Entity (XXE) attacks if entity resolution is not explicitly disabled, which can lead to local file disclosure or server-side request forgery (SSRF).
PROMPT_INJECTION (LOW): Indirect Prompt Injection surface detected. The skill's primary function is to ingest and process untrusted document data.
Ingestion points: ooxml/scripts/unpack.py (extracts user-supplied .docx, .pptx, or .xlsx files).
Boundary markers: Absent. The skill parses raw XML content without delimiters or warnings to the LLM about untrusted content.
Capability inventory: subprocess.run (executing soffice), file writing (repacking), and directory manipulation.
Sanitization: While defusedxml is used in some scripts (pack.py, unpack.py), the validation logic in docx.py uses standard lxml and the extraction logic is unhardened.
COMMAND_EXECUTION (LOW): ooxml/scripts/pack.py uses subprocess.run to call an external binary (soffice). While the call uses a list format which prevents simple shell injection, it relies on the presence of external system dependencies and processes files generated by the agent.

docx