The Agent Skills Directory

[Dynamic Execution] (HIGH): The file scripts/office/soffice.py contains a complete C source code string (_SHIM_SOURCE). At runtime, it writes this code to a temporary file, compiles it using gcc -shared -fPIC, and then executes LibreOffice (soffice) with the LD_PRELOAD environment variable pointing to the resulting shared library. While intended for compatibility (bypassing socket restrictions in sandboxes), runtime compilation and library injection are high-risk behaviors.
[Unverifiable Dependencies & Remote Code Execution] (MEDIUM): SKILL.md requires the installation of several external packages from public registries (markitdown, pptxgenjs, Pillow) and system utilities (LibreOffice, Poppler). These are executed with agent permissions without source verification.
[Indirect Prompt Injection] (LOW): The skill processes untrusted user-provided PowerPoint files and uses subagents to analyze rendered slide images, creating a vulnerability surface for indirect prompt injection.
Ingestion points: presentation.pptx (via markitdown extraction and thumbnail.py rendering).
Boundary markers: No explicit delimiters or instructions to ignore embedded content are used in the subagent prompts defined in SKILL.md.
Capability inventory: Extensive subprocess capabilities including soffice, pdftoppm, and gcc (via soffice.py).
Sanitization: No sanitization of extracted slide text or rendered visual content is performed before analysis.

pptx