The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): Path Traversal (ZipSlip) vulnerability in ooxml/scripts/unpack.py and ooxml/scripts/validation/docx.py. These scripts use zipfile.ZipFile.extractall() without validating archive member paths, allowing a malicious document to overwrite files outside the target directory using ../ sequences.\n- [REMOTE_CODE_EXECUTION] (LOW): External Command Execution in ooxml/scripts/pack.py. The script executes soffice via subprocess.run to validate document integrity. While arguments are passed as a list, this relies on an external binary to process untrusted data.\n- [DATA_EXFILTRATION] (LOW): Insecure XML Parsing in ooxml/scripts/validation/docx.py. The script uses lxml.etree.parse() without disabling external entities. This presents an XXE risk, as the parser might attempt to resolve and exfiltrate local file content or interact with internal network resources.

pptx