The Agent Skills Directory

[REMOTE_CODE_EXECUTION] (HIGH): Path Traversal (Zip Slip) vulnerability. The extraction logic in ooxml/scripts/unpack.py and ooxml/scripts/validation/docx.py uses zipfile.ZipFile.extractall() on input Office documents without validating the internal file paths. A crafted document containing entries with traversal sequences (e.g., ../../root/.ssh/authorized_keys) can be used to overwrite files outside the intended directory.\n
Evidence: ooxml/scripts/unpack.py line 15: zipfile.ZipFile(input_file).extractall(output_path)\n
Evidence: ooxml/scripts/validation/docx.py line 164: zip_ref.extractall(temp_dir)\n- [COMMAND_EXECUTION] (MEDIUM): The ooxml/scripts/pack.py script executes the soffice (LibreOffice) command via subprocess.run to validate documents. While the command arguments are constructed using path objects, calling external system binaries with user-influenced file paths is risky and depends on the security of the external tool.\n
Evidence: ooxml/scripts/pack.py line 103: subprocess.run(['soffice', ...])\n- [PROMPT_INJECTION] (LOW): Indirect Prompt Injection surface. The skill ingests untrusted ZIP/XML data from Office documents which could contain malicious instructions for downstream agent steps.\n
Ingestion points: ooxml/scripts/unpack.py (line 15) and ooxml/scripts/validation/docx.py (line 164).\n
Boundary markers: None; the scripts do not use delimiters or instructions to ignore embedded content during extraction or parsing.\n
Capability inventory: Subprocess execution (soffice), arbitrary file-write through Zip Slip, and XML manipulation.\n
Sanitization: Uses defusedxml.minidom to prevent XXE attacks, but does not sanitize file paths within the ZIP archives.

docx