The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): ZipSlip vulnerability detected in ooxml/scripts/unpack.py. The script uses zipfile.ZipFile.extractall() to unpack Office documents without validating the target paths of zip entries. A malicious .docx, .pptx, or .xlsx file containing filenames with directory traversal sequences (e.g., ../../target_file) could overwrite arbitrary files on the system, potentially leading to remote code execution if system scripts or configurations are targeted.
[Indirect Prompt Injection] (HIGH): The skill presents a high-risk attack surface for indirect prompt injection as it is designed to ingest and process external untrusted Office documents while possessing significant system capabilities.
Ingestion points: ooxml/scripts/unpack.py (extracting zip contents) and ooxml/scripts/validation/docx.py (parsing document XML files).
Boundary markers: Absent; the skill does not implement delimiters or explicit instructions for the agent to ignore embedded instructions within the processed document content.
Capability inventory: Command execution via soffice (LibreOffice) in pack.py, and file system write capabilities in both unpack.py and pack.py.
Sanitization: Inconsistent; while defusedxml is used in some modules, the primary extraction logic remains vulnerable to ZipSlip, and the validation logic uses potentially unsafe parsers.
[Dynamic Execution] (MEDIUM): Potential XML External Entity (XXE) risk in ooxml/scripts/validation/docx.py. The validator uses lxml.etree.parse on document components without explicitly disabling external entity resolution. While defusedxml is used elsewhere in the project, the use of lxml here creates a vulnerability window where a malicious document could attempt to read local files or perform SSRF via crafted XML entities.

docx