The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from .docx files which could be used for injection attacks.
Ingestion points: scripts/render_docx.py opens user-provided document files to parse XML metadata and perform rasterization.
Boundary markers: No explicit delimiters or instructions are used to distinguish document content from agent instructions during text extraction or visual review steps.
Capability inventory: The skill can execute system commands via subprocess.run and write files to tmp/docs/ and output/doc/.
Sanitization: While it uses standard libraries like ElementTree for XML and python-docx, it lacks specific sanitization for text content that might be interpreted by the LLM as instructions.
[COMMAND_EXECUTION]: The skill uses system calls to manage document conversion.
Evidence: scripts/render_docx.py uses subprocess.run() to execute soffice (LibreOffice) and pdftoppm (Poppler). The implementation uses argument lists rather than raw shell strings, which mitigates simple command injection, but the skill still operates on user-controlled file paths.

doc