The Agent Skills Directory

Dynamic Execution (MEDIUM): In scripts/office/soffice.py, a C source code shim is embedded as a string, written to a temporary file, compiled at runtime using gcc, and then loaded into the soffice process using the LD_PRELOAD environment variable. This is a high-risk technique typically used for process injection, though here it is intended to shim socket behavior in restricted environments.
Indirect Prompt Injection (LOW): The skill processes untrusted external Office files (.docx, .pptx, .xlsx), creating a vulnerability surface for indirect prompt injection.
Ingestion points: Files are ingested via ZIP extraction in unpack.py and XML reading in pack.py.
Boundary markers: No explicit boundary markers or instruction-ignoring delimiters are used when processing document content.
Capability inventory: The skill can execute gcc, soffice, and git via subprocess.run.
Sanitization: The skill uses defusedxml for XML parsing to prevent XXE attacks, but the content remains a surface for instruction-based attacks.
Command Execution (LOW): The skill executes various system utilities (soffice, gcc, git) using subprocess.run.

docx