The Agent Skills Directory

[COMMAND_EXECUTION]: The script ooxml/scripts/unpack.py is vulnerable to path traversal (Zip Slip) due to its use of zipfile.ZipFile.extractall() on potentially untrusted input files.
An attacker could craft a PPTX file containing filenames with traversal sequences (e.g., ../../) to overwrite sensitive files outside the intended extraction directory.
[PROMPT_INJECTION]: The skill has a high surface for indirect prompt injection as it ingests and processes text from existing PowerPoint presentations.
Ingestion points: Presentation content is extracted and read into the agent's context through ooxml/scripts/unpack.py, scripts/inventory.py, and scripts/replace.py.
Boundary markers: The instructions do not define clear boundaries or isolation protocols for data extracted from presentation slides.
Capability inventory: The skill possesses extensive capabilities including executing system commands via subprocess.run and rendering HTML slides in a headless browser via Playwright.
Sanitization: Although defusedxml provides protection against XML-specific attacks, the extracted content is treated as instructions or trusted data for subsequent operations, potentially leading to command injection or browser-based script execution.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of several external dependencies and system tools.
These include well-known libraries such as markitdown, playwright, pptxgenjs, and sharp from official registries.
It also utilizes system utilities like LibreOffice and Poppler-utils for document conversion and image generation tasks.

pptx