The Agent Skills Directory

[PROMPT_INJECTION]: The skill's primary function involves processing untrusted .docx files, which exposes an 'Indirect Prompt Injection' surface (Category 8). Maliciously crafted documents could contain instructions aimed at subverting the agent's behavior.
Ingestion points: Data enters the agent's context through pandoc text extraction and XML unpacking in ooxml/scripts/unpack.py.
Boundary markers: The skill does not currently implement specific delimiters or instructions to isolate and ignore embedded content within the extracted text.
Capability inventory: The skill utilizes subprocess.run for system commands (soffice, git, pandoc) and has file system write access via the Document library.
Sanitization: It uses defusedxml for secure XML parsing to prevent structural attacks, but it does not sanitize or filter the semantic text content of the documents before presentation to the agent.
[COMMAND_EXECUTION]: Several scripts including pack.py and redlining.py use the Python subprocess module to execute system commands such as soffice (LibreOffice), git, and pdftoppm. These calls are used for legitimate document conversion and validation purposes, but they represent a sensitive capability that relies on the safe handling of document file paths.

docx