The Agent Skills Directory

Unverifiable Dependencies & Remote Code Execution (HIGH): The script ooxml/scripts/unpack.py uses zipfile.ZipFile.extractall() on user-provided documents without path validation. This implementation is vulnerable to 'Zip Slip', allowing a malicious document with path traversal characters to overwrite arbitrary files on the system.
Dynamic Execution (MEDIUM): The ooxml/scripts/pack.py script executes the soffice (LibreOffice) binary via subprocess.run to validate documents. Processing untrusted documents with a complex application like LibreOffice increases the attack surface for the host environment.
Indirect Prompt Injection (LOW): The skill processes untrusted XML content from Office documents. While some components use defusedxml, ooxml/scripts/validation/docx.py uses lxml.etree.parse() which is not explicitly hardened against XML External Entity (XXE) attacks. (Evidence: 1. Ingestion points: ooxml/scripts/unpack.py and ooxml/scripts/validation/docx.py. 2. Boundary markers: None. 3. Capability inventory: subprocess.run in pack.py, zipfile.ZipFile.write in pack.py, shutil.copy2 in rearrange.py. 4. Sanitization: Partial use of defusedxml.)

pptx