The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script pptx/scripts/office/soffice.py performs runtime C compilation and process injection.
Evidence: The script hardcodes a C source string, writes it to a temporary file in the system temp directory, compiles it using gcc into a shared object library, and uses the LD_PRELOAD environment variable to inject the library into the soffice process.
[COMMAND_EXECUTION]: Several scripts execute system-level commands via subprocess.run for document processing and environment configuration.
Evidence: The skill executes gcc for shared library compilation, soffice for document conversion, pdftoppm for image generation, and git for diffing activities.
[EXTERNAL_DOWNLOADS]: The skill automates the installation of browser binaries from remote registries.
Evidence: SKILL.md contains the command npx playwright install chromium to fetch the browser required for PDF rendering.
[PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection by processing untrusted user-supplied project files with tools that have browser and shell capabilities.
Ingestion points: User project directory (HTML files).
Boundary markers: Absent; instructions do not include warnings to disregard instructions embedded in the input files.
Capability inventory: Shell command execution across multiple Python scripts and browser automation via Playwright.
Sanitization: Absent; HTML content is passed directly to rendering engines.

codeck-export