The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The file scripts/office/soffice.py contains a hardcoded C source code shim that is written to a temporary file and compiled at runtime using gcc. The resulting shared library is then injected into the soffice process using the LD_PRELOAD environment variable. This dynamic execution technique bypasses environment restrictions but is a high-risk pattern.
[COMMAND_EXECUTION]: The skill uses the subprocess module to execute external binaries including gcc for compilation, soffice for PowerPoint conversion, and pdftoppm for slide image generation.
[EXTERNAL_DOWNLOADS]: The skill performs several external downloads at runtime, including the installation of Python packages (python-pptx, markitdown, Pillow, lxml) via pip and fetching remote images using the requests library.
[DATA_EXFILTRATION]: Several scripts parse user-provided PowerPoint XML files using lxml.etree and xml.etree.ElementTree, which are susceptible to XML External Entity (XXE) attacks. This could potentially allow an attacker to read sensitive files if a malicious document is processed.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it unpacks and reads content from untrusted PPTX files without sanitization (ingestion point: scripts/office/unpack.py, boundary markers: absent, capabilities: network/subprocess/S3-write, sanitization: absent). Additionally, instructions in SKILL.md direct the agent to hardcode S3 URIs in scripts, which is a sub-optimal security practice.

pptx