The Agent Skills Directory

[REMOTE_CODE_EXECUTION] (HIGH): Path Traversal (ZipSlip) vulnerability in multiple files. * Evidence: In ooxml/scripts/unpack.py, the command zipfile.ZipFile(input_file).extractall(output_path) is used on user-provided Office files. Similarly, ooxml/scripts/validation/docx.py uses zip_ref.extractall(temp_dir). * Risk: A maliciously crafted .docx or .pptx file containing filenames with ../ sequences can overwrite sensitive files outside the intended directory, potentially leading to command execution (e.g., by overwriting shell profiles).
[DATA_EXFILTRATION] (HIGH): Insecure XML parsing using lxml on untrusted content. * Evidence: ooxml/scripts/validation/docx.py uses lxml.etree.parse(str(xml_file)) to process XML files extracted from user-provided documents. * Risk: lxml is vulnerable to XML External Entity (XXE) attacks. While defusedxml is used elsewhere, its omission in the validation logic allows an attacker to use malicious XML within a document to read local files or perform SSRF.
[COMMAND_EXECUTION] (MEDIUM): Execution of external binaries via subprocess. * Evidence: ooxml/scripts/pack.py executes soffice using subprocess.run. * Risk: While the arguments are largely constrained, invoking complex office suites on attacker-controlled files increases the attack surface to include any vulnerabilities within the office suite's conversion engine.
[PROMPT_INJECTION] (HIGH): Indirect Prompt Injection Surface (Category 8). * Ingestion points: unpack.py and validate.py process external Office files. * Boundary markers: None. * Capability inventory: Arbitrary file write (zipfile), command execution (soffice), and file system access. * Sanitization: Inadequate protection against path traversal in zip archives and XXE in XML parsing.

docx