The Agent Skills Directory

Unverifiable Dependencies & Remote Code Execution (HIGH): Zip Slip vulnerability in ooxml/scripts/unpack.py. The script uses zipfile.ZipFile(input_file).extractall(output_path) without validating member paths. A malicious Office document (ZIP archive) containing path traversal filenames (e.g., ../../target) can overwrite arbitrary files on the system.
Dynamic Execution (MEDIUM): Insecure XML parsing using lxml in ooxml/scripts/validation/docx.py. lxml.etree.parse() is used on extracted XML files without disabling entity resolution, creating a potential vector for XML External Entity (XXE) attacks.
Unverifiable Dependencies & Remote Code Execution (MEDIUM): External command execution of soffice. ooxml/scripts/pack.py calls subprocess.run(["soffice", ...]). Reliance on external binaries increases the attack surface if the binary is compromised or vulnerable.
Indirect Prompt Injection (HIGH): The skill processes untrusted Office documents, providing a significant attack surface for indirect injection.
Ingestion points: ooxml/scripts/unpack.py accepts external Office files for processing.
Boundary markers: None identified; the skill directly extracts and parses internal XML components.
Capability inventory: Includes file system extraction (zipfile), file modification, and external command execution (soffice).
Sanitization: Inconsistent; while defusedxml is used in some scripts, lxml and zipfile usage is unsafe.

docx