The Agent Skills Directory

[COMMAND_EXECUTION] (MEDIUM): The file ooxml/scripts/pack.py uses subprocess.run to execute the soffice (LibreOffice) command. While the arguments are structured, processing untrusted Office files through a complex external suite like LibreOffice increases the attack surface for document-based exploits.
[DATA_EXPOSURE] (HIGH): In ooxml/scripts/unpack.py, the script uses zipfile.ZipFile(input_file).extractall(output_path) without validating the member names within the ZIP archive. This exposes the system to a 'Zip Slip' attack, where a maliciously crafted document could contain relative paths (e.g., ../../etc/passwd) to overwrite arbitrary files on the host system.
[INDIRECT_PROMPT_INJECTION] (HIGH): The skill is specifically designed to ingest and process untrusted external data in the form of Office documents.
Ingestion points: ooxml/scripts/unpack.py and ooxml/scripts/validate.py ingest .docx, .pptx, and .xlsx files.
Boundary markers: None. The skill parses raw XML content from the archives.
Capability inventory: The skill possesses file-system write capabilities (via extractall) and external command execution capabilities (via soffice).
Sanitization: Although the skill uses defusedxml to prevent XML External Entity (XXE) attacks, it lacks sanitization for the ZIP file structure itself.

docx