docx
Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files). Triggers include: any mention of 'Word doc', 'word document', '.docx', or requests to produce professional documents with formatting like tables of contents, headings, page numbers, or letterheads. Also use when extracting or reorganizing content from .docx files, inserting or replacing images in documents, performing find-and-replace in Word files, working with tracked changes or comments, or converting content into a polished Word document. If the user asks for a 'report', 'memo', 'letter', 'template', or similar deliverable as a Word or .docx file, use this skill. Do NOT use for PDFs, spreadsheets, Google Docs, or general coding tasks unrelated to document generation.
93
94%
Does it follow best practices?
Impact
93%
1.52xAverage score across 8 eval scenarios
Critical
Do not install without reviewing
The canonical home for this skill is docx in anthropics/skills
Security
1 critical severity finding. Installing this skill is not recommended: please review these findings carefully if you do intend to do so.
E004: Prompt injection detected in skill instructions.
What this means
Detected a prompt injection in the skill instructions. The skill contains hidden or deceptive instructions that fall outside its stated purpose and attempt to override the agent’s safety guidelines or intended behavior.
Why it was flagged
The skill contains instructions to default authorship to "Claude" and code that installs LibreOffice macros and an LD_PRELOAD C shim to bypass AF_UNIX/socket restrictions, which steer users to weaken environment/security boundaries and impersonate authors (suspicious but not clearly malicious).
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The DOCX skill’s runtime workflow reads and processes outsider-authored free text when it unpacks a user-provided .docx/.xml file (e.g., `word/document.xml`), pretty-prints it, and extracts text for validation/redlining via `scripts/office/unpack.py` and `scripts/office/validators/redlining.py`.
- Repository
- UnicomAI/wanwu
- Commit
99df6e4
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.