word-document-processor
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Office documents (.docx and .pptx) which are unpacked into XML and converted to markdown for analysis. This creates a surface for indirect prompt injection where instructions embedded in a document could attempt to override agent behavior.
- Ingestion points: XML data is read from user-supplied files in ooxml/scripts/unpack.py and scripts/document.py.
- Boundary markers: Instructions in SKILL.md for reading extracted content (via pandoc) do not provide explicit delimiters or warnings to ignore instructions embedded in the content.
- Capability inventory: The skill uses subprocess.run to execute standard utilities including soffice, pandoc, and git (found in ooxml/scripts/pack.py and ooxml/scripts/validation/redlining.py).
- Sanitization: The skill effectively uses the defusedxml library for all XML parsing operations, providing robust protection against XXE attacks. These risks are inherent to the document processing functionality and are well-managed by the skill implementation.
Audit Metadata