The Agent Skills Directory

[DATA_EXFILTRATION] (HIGH): Vulnerable XML parsing of untrusted DOCX content. * Evidence: scripts/render_docx.py uses xml.etree.ElementTree.fromstring(xml) in the calc_dpi_via_ooxml_docx function. * Risk: The standard ElementTree library does not prevent external entity expansion. A crafted DOCX file (which is a ZIP container of XML files) can include malicious entities to read local files (e.g., /etc/passwd) or probe internal network services.
[COMMAND_EXECUTION] (MEDIUM): Subprocess execution of system binaries with untrusted input paths. * Evidence: scripts/render_docx.py invokes soffice (LibreOffice) and pdftoppm using subprocess.run. * Risk: While the script uses a list for arguments, processing complex, potentially malformed document formats using a headless office suite exposes a significant attack surface for exploitation of the underlying binaries.
[REMOTE_CODE_EXECUTION] (HIGH): Indirect Prompt Injection surface. * Ingestion points: Untrusted DOCX files are ingested via input_path in scripts/render_docx.py. * Boundary markers: None; the script immediately parses and processes the file content. * Capability inventory: Includes subprocess.run (LibreOffice execution), ZipFile operations, and file writing to output/ and tmp/. * Sanitization: Missing; there is no validation of the XML structure or document integrity prior to processing with high-privilege tools.

doc