The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions to the agent to override standard operational constraints, specifically directing it to 'NEVER set any range limits' when using file-reading tools. This pattern is designed to bypass built-in safety and performance guardrails. \n- [PROMPT_INJECTION]: The workflow extracts text from external documents and presents it to the agent without using delimiters or sanitization instructions. This creates a surface for indirect prompt injection, where a malicious document could manipulate the agent into performing unauthorized actions. \n- [COMMAND_EXECUTION]: Multiple scripts within the skill use the subprocess module to execute system binaries such as git, soffice (LibreOffice), and pdftoppm. The skill also provides setup instructions that involve sudo for environment configuration, which poses a risk of privilege escalation. \n- [DATA_EXFILTRATION]: The ooxml/scripts/validation/redlining.py script uses the standard library xml.etree.ElementTree for parsing, which is documented as insecure against XML External Entity (XXE) attacks. This vulnerability could be exploited by a malicious document to access sensitive local files or probe internal networks. \n- [EXTERNAL_DOWNLOADS]: The skill depends on various external software tools like pandoc and the docx npm package. The installation instructions in SKILL.md lack version pinning and integrity verification, making the environment susceptible to supply chain risks or the installation of unverified software.

docx