The Agent Skills Directory

Indirect Prompt Injection (LOW): The skill serves as an ingestion point for untrusted Office document data, which creates a surface for indirect prompt injection attacks where malicious instructions are hidden in processed files.
Ingestion points: ooxml/scripts/unpack.py extracts contents from external zip-based Office files into a local directory.
Boundary markers: Absent. There are no markers or delimiters used to separate the extracted XML content from the agent's system instructions.
Capability inventory: The skill possesses capabilities for zip extraction, file writing, XML parsing, and external command execution.
Sanitization: While defusedxml is used in some scripts, lxml.etree.parse is used in ooxml/scripts/validation/docx.py without security hardening (e.g., disabling entity resolution).
Dynamic Execution (LOW): The ooxml/scripts/pack.py script executes the soffice (LibreOffice) binary via subprocess.run to perform validation. Although arguments are passed as a list to prevent shell injection, this relies on the security of an external system component.
Data Exposure & Exfiltration (LOW): In ooxml/scripts/unpack.py, the use of zipfile.extractall() is vulnerable to path traversal (Zip Slip). A malicious Office document could contain filenames with ../ sequences to overwrite files outside the intended output directory.
Unverifiable Dependencies & Remote Code Execution (SAFE): The skill utilizes well-known Python packages lxml and defusedxml. No suspicious remote downloads or untrusted dependency installations were detected.

docx-processing-anthropic