The Agent Skills Directory

[COMMAND_EXECUTION]: The script ooxml/scripts/unpack.py uses zipfile.ZipFile.extractall() without validating archive member paths.\n
Evidence: Found in ooxml/scripts/unpack.py. This creates a ZipSlip vulnerability, where a maliciously crafted .pptx file (which is a ZIP archive) could contain traversal sequences like ../../ to overwrite sensitive files (e.g., shell profiles or SSH keys) on the host system.\n- [COMMAND_EXECUTION]: Several utilities in the skill's script directories perform system calls using subprocess.run.\n
Evidence: Found in scripts/thumbnail.py, ooxml/scripts/pack.py, and ooxml/scripts/validation/redlining.py. These execute binaries such as soffice, pdftoppm, and git using file paths provided as input without explicit sanitization.\n- [DYNAMIC_EXECUTION]: The skill uses the Playwright library to launch a Chromium browser instance for rendering HTML slides.\n
Evidence: Found in scripts/html2pptx.js. Rendering content via a full browser engine on content that may be derived from external sources or generated without strict sandboxing introduces a complex attack surface.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied presentation files and makes their content available to the agent context without isolation.\n
Ingestion points: Slide text is extracted using markitdown and raw XML analysis as instructed in SKILL.md.\n
Boundary markers: Absent; no delimiters are used to separate slide content from instructions.\n
Capability inventory: Subprocess execution, file modification, and browser execution.\n
Sanitization: Absent; extracted text is not filtered before entering the agent's context.\n- [SAFE]: XML parsing in the unpacking and packing scripts uses the defusedxml library.\n
Evidence: Found in ooxml/scripts/unpack.py and ooxml/scripts/pack.py. This appropriately mitigates the risk of XML External Entity (XXE) attacks.

pptx