The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): The script scripts/office/soffice.py dynamically generates a C source file and executes the system gcc compiler to create a shared library (lo_socket_shim.so) at runtime. This behavior is a high-risk pattern for executing arbitrary code.\n- [REMOTE_CODE_EXECUTION] (HIGH): The file scripts/office/soffice.py utilizes LD_PRELOAD to inject the dynamically compiled shared library into the soffice process. Such process injection techniques are frequently used in exploitation and require strict isolation.\n- [COMMAND_EXECUTION] (MEDIUM): scripts/accept_changes.py uses subprocess.run to execute LibreOffice with a StarBasic macro string passed as a command-line argument to automate the acceptance of tracked changes.\n- [COMMAND_EXECUTION] (LOW): The scripts/office/validators/redlining.py utility invokes the system git binary to perform word-level comparisons between document versions.\n- [SAFE] (SAFE): The skill consistently uses defusedxml for XML parsing in its primary processing scripts, which effectively mitigates XML External Entity (XXE) attacks.

docx