The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): The scripts ooxml/scripts/unpack.py and ooxml/scripts/validation/docx.py use zipfile.ZipFile.extractall() on input files without validating member paths. This is a Zip Slip vulnerability that allows an attacker to write files anywhere on the filesystem reachable by the process using directory traversal (e.g., ../../.bashrc). Since this is associated with the primary purpose of the skill, the severity is considered MEDIUM in the final verdict calculation.\n- [COMMAND_EXECUTION] (MEDIUM): ooxml/scripts/pack.py executes the soffice (LibreOffice) binary via subprocess.run to validate documents. While using a list-based command minimizes shell injection, processing untrusted documents through a complex office suite exposes the environment to LibreOffice's internal vulnerabilities.\n- [DATA_EXFILTRATION] (MEDIUM): ooxml/scripts/validation/docx.py uses lxml.etree.parse() to process XML files. By default, lxml can resolve external entities, which could lead to XXE attacks (reading local files) if the processed document contains malicious XML.\n- [PROMPT_INJECTION] (LOW): This skill provides an Indirect Prompt Injection surface.\n
Ingestion points: Office documents processed via ooxml/scripts/unpack.py and analyzed in ooxml/scripts/validation/docx.py.\n
Boundary markers: Not present.\n
Capability inventory: File system writes (Zip Slip), subprocess execution (soffice), and document content reading.\n
Sanitization: Partial; defusedxml is used in some scripts, but security flags for lxml and path validation for zip extraction are missing.

pptx