The Agent Skills Directory

Command Execution (MEDIUM): The file scripts/office/soffice.py performs runtime compilation of a C shim using gcc and injects it into the soffice process via LD_PRELOAD. This is a sophisticated process injection technique. While necessary for the skill's functionality in certain environments, it is a high-risk pattern. The severity is adjusted to MEDIUM as it is essential to the primary task.\n- Command Execution (MEDIUM): The soffice.py script uses a fixed, predictable filename in a world-writable directory (/tmp/lo_socket_shim.so) for its compiled library. This is vulnerable to symlink attacks or library hijacking by other local users.\n- Command Execution (LOW): The script scripts/recalc.py writes a persistent Basic macro to the LibreOffice configuration directory (Module1.xba). This modifies the application state across sessions, which could be used for persistence, although here it is used for formula recalculation.\n- Indirect Prompt Injection (LOW): The skill ingests and parses untrusted Office documents, which serves as a surface for indirect prompt injection.\n
Ingestion points: Document data is read via unpack.py, recalc.py, and validate.py.\n
Boundary markers: No explicit delimiters or instructions were found in the code to isolate document content from the agent's logic.\n
Capability inventory: The skill can execute system commands (gcc, git, soffice) and write files to the local system.\n
Sanitization: The skill utilizes defusedxml to mitigate XXE vulnerabilities, but lacks sanitization for the semantic content or formulas within the processed files.

xlsx