The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill performs runtime code generation, compilation, and injection.
The script scripts/office/soffice.py contains an embedded C source code string (_SHIM_SOURCE) that is written to a temporary file and compiled using gcc at runtime.
The resulting shared library is then loaded into the soffice process using the LD_PRELOAD environment variable to intercept system calls.
[COMMAND_EXECUTION]: The skill executes arbitrary commands and performs unsafe file operations.
The script scripts/recalc.py injects a LibreOffice Basic macro into the user's application configuration directory (~/.config/libreoffice/4/user/basic/Standard/Module1.xba or macOS equivalent) to automate formula recalculation.
The unpack function in scripts/office/unpack.py uses zipfile.ZipFile.extractall() on user-provided Office documents without path sanitization, creating a ZipSlip vulnerability that allows for path traversal and arbitrary file write.
Multiple scripts use subprocess.run to execute external binaries including soffice, gcc, and git across various modules (scripts/recalc.py, scripts/office/soffice.py, scripts/office/validators/redlining.py).
[PROMPT_INJECTION]: The skill has a significant surface area for indirect prompt injection.
The agent is instructed to process external spreadsheets and documents which enter the context through scripts/recalc.py and scripts/office/unpack.py.
There are no boundary markers or explicit safety instructions to prevent the agent from obeying malicious prompts embedded within these user-provided files.

xlsx