The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes external .docx files and converts them to markdown or raw XML, creating a potential surface for indirect prompt injection where malicious instructions embedded in a document could attempt to influence agent behavior.
Ingestion points: document content is ingested via ooxml/scripts/unpack.py and the Document class in scripts/document.py.
Boundary markers: The skill does not currently employ explicit delimiters or 'ignore instructions' warnings when presenting extracted text to the agent.
Capability inventory: The skill has the ability to write to the local filesystem and execute system commands (e.g., pandoc, soffice).
Sanitization: While the skill lacks NL-level sanitization, it rigorously uses defusedxml to sanitize the XML parsing layer, effectively mitigating technical injection attacks like XXE (XML External Entity).
[COMMAND_EXECUTION]: The skill executes several system utilities to perform document processing tasks.
Trusted Tools: Uses pandoc, soffice (LibreOffice), pdftoppm, and git via subprocess.run with argument lists, which prevents shell injection.
Extraction: Uses zipfile.extractall in ooxml/scripts/unpack.py to extract document contents. While extractall can be sensitive to directory traversal (ZipSlip) in some environments, it is used here within the local workspace for the skill's primary purpose.
[EXTERNAL_DOWNLOADS]: The skill references several external dependencies required for its primary operations.
Dependencies: Requires the installation of pandoc, LibreOffice, poppler-utils, and the docx NPM package. These are well-known, industry-standard tools and are treated as safe, trusted sources.

docx