The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): Vulnerability to 'Zip Slip' path traversal in ooxml/scripts/unpack.py and ooxml/scripts/validation/docx.py. The scripts use zipfile.ZipFile.extractall() on untrusted input files without validating the paths of the members within the archive. An attacker could craft a malicious Office document containing file entries with '..' path segments to overwrite sensitive files outside the intended extraction directory.
[COMMAND_EXECUTION] (MEDIUM): The script ooxml/scripts/pack.py uses subprocess.run to call the soffice binary for document validation. While it uses an argument list to prevent shell injection, executing a complex external utility on untrusted data remains a significant security risk.
[DATA_EXFILTRATION] (SAFE): No hardcoded credentials or unauthorized network operations were detected.
[PROMPT_INJECTION] (SAFE): No instructions targeting agent behavior or safety filter bypass were found.

pptx