The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): Zip Slip / Directory Traversal vulnerability in ooxml/scripts/unpack.py.
Evidence: The line zipfile.ZipFile(input_file).extractall(output_path) extracts the contents of an Office document without validating the internal file paths. Malicious ZIP entries containing directory traversal sequences (e.g., ../../) can overwrite sensitive files outside the intended destination directory.
Category 8 (Indirect Prompt Injection) Evidence Chain:
Ingestion points: ooxml/scripts/unpack.py accepts untrusted Office documents as input.
Boundary markers: Absent; the skill does not use delimiters or warnings to isolate untrusted content.
Capability inventory: The skill possesses file-writing capabilities via extractall() and Presentation.save().
Sanitization: Absent; member names in the ZIP archive are not validated for safety before extraction.
[COMMAND_EXECUTION] (LOW): Subprocess execution of soffice.
Evidence: In ooxml/scripts/pack.py, the skill executes soffice (LibreOffice) for document validation. While it uses the safer list-based subprocess.run method, it relies on an external binary and processes untrusted files through it.
[INFO]: Protection against XML External Entity (XXE) attacks.
Evidence: The skill correctly utilizes defusedxml.minidom for XML parsing in both pack.py and unpack.py, demonstrating a good baseline for secure data handling.

pptx