The Agent Skills Directory

[REMOTE_CODE_EXECUTION] (CRITICAL): The unpack.py script is vulnerable to a Zip Slip attack. \n
Evidence: File ooxml/scripts/unpack.py uses zipfile.ZipFile(input_file).extractall(output_path). This function does not securely validate that the paths within the ZIP archive are contained within the target directory, potentially allowing an attacker to overwrite critical system files or scripts (e.g., .bashrc) if the agent processes a malicious document. \n- [DATA_EXFILTRATION] (HIGH): Potential XML External Entity (XXE) vulnerability in document validation. \n
Evidence: File ooxml/scripts/validation/docx.py uses lxml.etree.parse() to process XML files from the unpacked document. lxml does not disable the resolution of external entities by default. An attacker could craft a document.xml containing a malicious DTD to read local files or perform Server-Side Request Forgery (SSRF). \n- [COMMAND_EXECUTION] (MEDIUM): Subprocess execution of LibreOffice (soffice) in ooxml/scripts/pack.py. \n
Evidence: File ooxml/scripts/pack.py executes the soffice command to validate documents. While the command is constructed as a list, processing untrusted, complex file formats through a large office suite increases the attack surface for secondary vulnerabilities. \n- [REMOTE_CODE_EXECUTION] (HIGH): Indirect Prompt Injection Surface. \n
Ingestion points: ooxml/scripts/unpack.py ingests untrusted .docx, .pptx, and .xlsx files from external sources. \n
Boundary markers: None identified. \n
Capability inventory: File system write access and external command execution (subprocess.run). \n
Sanitization: Inconsistent. While defusedxml is used in some scripts, raw lxml is used in validation logic, and Zip archive members are not sanitized.

pptx