The Agent Skills Directory

[PROMPT_INJECTION] (HIGH): The skill presents a large attack surface for indirect prompt injection.
Ingestion points: The ooxml/scripts/unpack.py and ooxml/scripts/validation/docx.py scripts read XML data directly from user-provided Office files.
Boundary markers: No boundary markers or clear instructions are implemented to distinguish document content from agent instructions.
Capability inventory: The skill can execute system commands (soffice in pack.py), write files to the local disk, and delete files (output_file.unlink() in pack.py).
Sanitization: While defusedxml is used for formatting, it is not consistently applied to the validation logic, and document content is not sanitized before being returned to the agent context.
[COMMAND_EXECUTION] (MEDIUM): In ooxml/scripts/pack.py, the validate_document function executes the soffice (LibreOffice) binary via subprocess.run. Invoking complex external applications on untrusted inputs can expose the host system to vulnerabilities present in the office suite.
[DATA_EXFILTRATION] (HIGH): The script ooxml/scripts/validation/docx.py uses lxml.etree.parse to evaluate XML files. By default, lxml may resolve external entities, which facilitates XML External Entity (XXE) attacks. This could allow a malicious document to read sensitive files from the local filesystem and expose them through the validator's output.

pptx