{"id":"cmuxhofgu01q1ad07dfmes7b4","slug":"docx-2","publicId":"07349e61-9916-4832-aa9d-c68839a8847a","name":"docx","description":"Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files) or Word templates (.dotx files). Triggers include: any mention of 'Word doc', 'word document', '.docx', '.dotx', or requests to produce professional documents with formatting like tables of contents, headings, page numbers, or letterheads. Also use when extracting or reorganizing content from .docx or .dotx files, inserting or replacing images in documents, performing find-and-replace in Word files, working with tracked changes or comments, or converting content into a polished Word document. If the user asks for a 'report', 'memo', 'letter', 'template', or similar deliverable as a Word or .docx file, use this skill. Do NOT use for PDFs, spreadsheets, Google Docs, or general coding tasks unrelated to document generation.","version":"","author":"anthropics","license":"Proprietary. LICENSE.txt has complete terms","compatibility":"","status":"completed","overallGrade":"F","scannerVersion":11,"fileCount":61,"hasSkillMd":true,"hasScripts":true,"hasReferences":false,"hasEvals":false,"hasAssets":false,"sourceType":"github","sourceUrl":"https://github.com/anthropics/skills/tree/main/skills/docx","createdAt":"2026-10-07T02:29:17.180Z","completedAt":"2026-10-07T02:29:17.173Z","visibility":"public","publishedAt":"2026-06-03T18:56:52.721Z","category":"","frameworks":[],"badgeStatus":"flagged","downloadCount":0,"verdictRationale":{"summary":"Skill failed: 0 hard fails in skill checks.","verdict":"fail","scanners":[{"source":"vettd","weight":1,"verdict":null},{"source":"cisco","weight":0.8,"verdict":"fail"}],"consensus":"fail","warnTriggers":[],"policyVersion":"consensus-v1","hardFailTriggers":[]},"verdictPolicyVersion":"consensus-v1","skillId":"cmpyfh58p005kad07ipszjseh","findings":[{"id":"cmuxhofgw01q5ad07fygnex1q","source":"cisco","category":"security","label":"Shell command execution with string formatting (potential injection)","detail":"scripts/accept_changes.py:99 — Pattern detected: subprocess.run(\n            [\n                \"soffice\",\n                \"--headless\",\n                f\"-env:UserInstallation=file://{LIBREOFFICE_PROFILE}","severity":"critical","ruleId":"COMMAND_INJECTION_OS_SYSTEM","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"ed19fe9f8600c09e0b530eb383e50ddc","filepath":"scripts/accept_changes.py"},{"id":"cmuxhofgv01q2ad07t3nl332s","source":"cisco","category":"security","label":"Archive extraction followed by execution","detail":"SKILL.md:45 — An archive is extracted and its contents are then executed. This pattern can deliver and run malicious payloads hidden in archives.","severity":"high","ruleId":"COMPOUND_EXTRACT_EXECUTE","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"70f8837531d88db10f87cdabac08e048","filepath":"SKILL.md"},{"id":"cmuxhofgv01q3ad07o7cbniin","source":"cisco","category":"security","label":"Archive extraction followed by execution","detail":"SKILL.md:51 — An archive is extracted and its contents are then executed. This pattern can deliver and run malicious payloads hidden in archives.","severity":"high","ruleId":"COMPOUND_EXTRACT_EXECUTE","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"70f8837531d88db10f87cdabac08e048","filepath":"SKILL.md"},{"id":"cmuxhofgw01q8ad07wnbf72o4","source":"cisco","category":"security","label":"Bulk process environment snapshot can expose credentials and tokens","detail":"scripts/office/soffice.py:28 — Pattern detected: os.environ.copy(","severity":"medium","ruleId":"DATA_EXFIL_ENV_VARS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"9cc158238592931e82b28a4c5743c2f7","filepath":"scripts/office/soffice.py"},{"id":"cmuxhofgw01q4ad073u1yxyij","source":"cisco","category":"security","label":"Script contacts a destination the documentation never mentions","detail":"scripts/accept_changes.py:21 — Script contacts or configures 'openoffice.org' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.","severity":"low","ruleId":"UNDECLARED_NETWORK_DESTINATION","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"9334ae1a19215fd9b805da9b1a19e63a","filepath":"scripts/accept_changes.py"},{"id":"cmuxhofgw01q6ad07vvfqyumd","source":"cisco","category":"security","label":"Script contacts a destination the documentation never mentions","detail":"scripts/comment.py:43 — Script contacts or configures 'schemas.microsoft.com' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.","severity":"low","ruleId":"UNDECLARED_NETWORK_DESTINATION","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"e01497de48f03194555bad6ca45f2bf2","filepath":"scripts/comment.py"},{"id":"cmuxhofgw01q7ad07v8mkured","source":"cisco","category":"security","label":"Script contacts a destination the documentation never mentions","detail":"scripts/merge_runs.py:37 — Script contacts or configures 'schemas.openxmlformats.org' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.","severity":"low","ruleId":"UNDECLARED_NETWORK_DESTINATION","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"665b9fff6c754e410c636534ea5e11bb","filepath":"scripts/merge_runs.py"}],"scannerRuns":[{"source":"cisco","status":"success","verdict":null,"grade":"F","findingCount":7,"criticalCount":1,"highCount":3},{"source":"vettd","status":"success","verdict":null,"grade":"A","findingCount":0,"criticalCount":0,"highCount":0}],"user":{"name":"Justin Pacella","image":"https://avatars.githubusercontent.com/u/97124458?v=4"},"repository":{"owner":"anthropics","name":"skills"},"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-22T21:04:28.176Z","lastVerifiedAt":"2026-10-22T21:04:28.176Z","lastChangeDetectedAt":"2026-08-14T11:52:28.471Z","scannedHash":"6e6f5b95c1de6e803cc07b214f5059b074d64e0c","latestUpstreamHash":"6e6f5b95c1de6e803cc07b214f5059b074d64e0c","nextCheckDueAt":"2026-10-23T23:17:56.527Z"},"signalCategories":[{"category":"safety","label":"Safety","form":"graded","verdict":null,"rows":[]},{"category":"reliability","label":"Reliability & Quality","form":"graded","verdict":null,"rows":[]},{"category":"performance","label":"Performance","form":"measured","verdict":{"form":"measured","magnitudes":[{"ruleId":"performance/static-context-tokens","label":"Static context tokens","value":1567,"unit":null,"method":"tiktoken/cl100k_base/skill-md-body"}]},"rows":[{"origin":"signal","id":"cmuxhog3801read074sddtx19","subjectType":"skill_audit","subjectId":"cmuxhofgu01q1ad07dfmes7b4","relatedType":"","relatedId":"","dataCategory":"performance","sourceClass":"scan","source":"vettd","ruleId":"performance/static-context-tokens","severity":null,"label":"Static context tokens","detail":null,"valueNum":1567,"valueText":null,"unit":null,"method":"tiktoken/cl100k_base/skill-md-body","derivation":null,"confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T02:29:13.000Z","payload":null},{"origin":"signal","id":"cmuxhogh701t9ad07bl20jxyr","subjectType":"skill_audit","subjectId":"cmuxhofgu01q1ad07dfmes7b4","relatedType":"","relatedId":"","dataCategory":"performance","sourceClass":"scan","source":"vettd","ruleId":"performance/progressive-disclosure","severity":null,"label":"Progressive disclosure","detail":null,"valueNum":null,"valueText":"present","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T02:29:13.000Z","payload":null}]},{"category":"cost","label":"Cost","form":"measured","verdict":null,"rows":[]},{"category":"compatibility","label":"Compatibility","form":"unjudged","verdict":{"form":"unjudged"},"rows":[{"origin":"signal","id":"cmuxhog5n01rkad07bcr9hes7","subjectType":"skill_audit","subjectId":"cmuxhofgu01q1ad07dfmes7b4","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/declared-environment-assumptions","severity":null,"label":"Declared environment assumptions","detail":null,"valueNum":null,"valueText":"","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T02:29:13.000Z","payload":null},{"origin":"signal","id":"cmuxhogbw01slad071lrc3t06","subjectType":"skill_audit","subjectId":"cmuxhofgu01q1ad07dfmes7b4","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/declared-name","severity":null,"label":"Declared skill name","detail":null,"valueNum":null,"valueText":"docx","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T02:29:13.000Z","payload":null},{"origin":"signal","id":"cmuxhoghe01tbad07q0rlwryg","subjectType":"skill_audit","subjectId":"cmuxhofgu01q1ad07dfmes7b4","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/cli-help","severity":null,"label":"CLI help","detail":null,"valueNum":null,"valueText":"present","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T02:29:13.000Z","payload":null},{"origin":"signal","id":"cmuxhoghj01tdad07c7glm70c","subjectType":"skill_audit","subjectId":"cmuxhofgu01q1ad07dfmes7b4","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/structured-output","severity":null,"label":"Structured output","detail":null,"valueNum":null,"valueText":"absent","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T02:29:13.000Z","payload":null}]},{"category":"sentiment","label":"Popularity","form":"unjudged","verdict":null,"rows":[]},{"category":"characteristics","label":"Characteristics","form":"unjudged","verdict":null,"rows":[]}],"signalCount":33,"publisherSupplied":["name","description","author","version","license"]}