The Agent Skills Directory

Dynamic Execution (HIGH): The file scripts/office/soffice.py contains a hardcoded C source string that is written to a temporary file and compiled using gcc at runtime. The resulting shared object is then injected into the soffice (LibreOffice) binary using the LD_PRELOAD environment variable. This technique allows the skill to override system-level socket calls but also bypasses standard security controls.
Command Execution (MEDIUM): The skill frequently invokes external binaries via subprocess.run. This includes calling gcc for the shim compilation and soffice for processing document changes in scripts/accept_changes.py and scripts/office/soffice.py.
Command Execution (LOW): The validation utility in scripts/office/validators/redlining.py executes the git binary to generate word-level diffs when comparing document content.
Indirect Prompt Injection (LOW): The skill is designed to process external, untrusted document files which constitutes an attack surface. \n
Ingestion points: scripts/office/unpack.py extracts XML content from .docx, .pptx, and .xlsx files. \n
Boundary markers: Absent; the skill processes document XML structure without explicit delimiters or instructions to ignore embedded content. \n
Capability inventory: The skill can execute shell commands, compile C code, write to the filesystem, and manipulate document metadata. \n
Sanitization: The skill correctly employs defusedxml to mitigate XML External Entity (XXE) attacks, but it does not sanitize the logical text content of the documents for potentially malicious agent instructions.

docx