The Agent Skills Directory

[DATA_EXFILTRATION] (MEDIUM): Unsafe XML parsing with lxml. The ooxml/scripts/validation/docx.py file uses lxml.etree.parse() to process document components. Without explicitly setting resolve_entities=False, the parser is vulnerable to XML External Entity (XXE) attacks, which can be leveraged to read sensitive local files or perform server-side request forgery (SSRF).
[COMMAND_EXECUTION] (LOW): Risk of arbitrary file write via Zip Slip. In ooxml/scripts/unpack.py and ooxml/scripts/validation/docx.py, the skill uses zipfile.ZipFile.extractall() on user-provided Office documents. This pattern is dangerous when handling untrusted archives, as it can potentially overwrite files outside the target directory in environments with older Python versions or misconfigured permissions.
[COMMAND_EXECUTION] (LOW): Execution of complex external binary. The ooxml/scripts/pack.py script executes the soffice (LibreOffice) binary via subprocess.run to validate documents. Calling heavy external office suites on untrusted files increases the attack surface, as document parsers are common targets for memory corruption exploits.
[PROMPT_INJECTION] (LOW): Surface for Indirect Prompt Injection. The skill processes external OOXML data that could contain malicious instructions designed to exploit the aforementioned vulnerabilities or influence the agent's behavior.
Ingestion points: ooxml/scripts/unpack.py and ooxml/scripts/validation/docx.py (reads external .docx, .pptx, and .xlsx files).
Boundary markers: Absent. The skill does not implement delimiters or warnings to isolate processed content from the agent's instruction context.
Capability inventory: File system write access (zipfile, Path.write_bytes), Subprocess execution (soffice).
Sanitization: Inconsistent. While defusedxml is used for some operations in pack.py, the validation logic in docx.py relies on the less secure lxml parser.

pptx