Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/nicepkg/ai-workflow/docxnpx skills add nicepkg/ai-workflow --skill docxgit clone --depth 1 https://github.com/nicepkg/ai-workflowWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00077 | $0.02473 |
| Opus 5 | $0.00039 | $0.01236 |
| Sonnet 5 | $0.00015 | $0.00495 |
| Haiku 4.5 | $0.00008 | $0.00247 |
Grade B, and why
docx scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- **pandoc**: `sudo apt-get install pandoc` (for text extraction) This is a copy
98% identical to docx — 3 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 197 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DOCX creation, editing, and analysis
Overview
A user may ask you to create, edit, or analyze the contents of a .docx file. A .docx file is essentially a ZIP archive containing XML files and other resources that you can read or edit. You have different tools and workflows available for different tasks.
Workflow Decision Tree
Reading/Analyzing Content
Use "Text extraction" or "Raw XML access" sections below
Creating New Document
Use "Creating a new Word document" workflow
Editing Existing Document
-
Your own document + simple changes Use "Basic OOXML editing" workflow
-
Someone else's document Use "Redlining workflow" (recommended default)
-
Legal, academic, business, or government docs Use "Redlining workflow" (required)
Reading and analyzing content
Text extraction
If you just need to read the text contents of a document, you should convert the document to markdown using pandoc. Pandoc provides excellent support for preserving document structure and can show tracked changes:
# Convert document to markdown with tracked changes
pandoc --track-changes=all path-to-file.docx -o output.md
# Options: --track-changes=accept/reject/all
Raw XML access
You need raw XML access for: comments, complex formatting, document structure, embedded media, and metadata. For any of these features, you'll need to unpack a document and read its raw XML contents.
Unpacking a file
python ooxml/scripts/unpack.py <office_file> <output_directory>
Key file structures
word/document.xml- Main document contentsword/comments.xml- Comments referenced in document.xmlword/media/- Embedded images and media files- Tracked changes use
<w:ins>(insertions) and<w:del>(deletions) tags
Creating a new Word document
When creating a new Word document from scratch, use docx-js, which allows you to create Word documents using JavaScript/TypeScript.
Workflow
- MANDATORY - READ ENTIRE FILE: Read
docx-js.md(~500 lines) completely from start to finish. NEVER set any range limits when reading this file. Read the full file content for detailed syntax, critical formatting rules, and best practices before proceeding with document creation. - Create a JavaScript/TypeScript file using Document, Paragraph, TextRun components (You can assume all dependencies are installed, but if not, refer to the dependencies section below)
- Export as .docx using Packer.toBuffer()
What ships with it
58 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- docx-js.md 16 KB
- LICENSE.txt 1.4 KB
- ooxml.md 23 KB
- ooxml/schemas/ecma/fouth-edition/opc-contentTypes.xsd 1.9 KB
- ooxml/schemas/ecma/fouth-edition/opc-coreProperties.xsd 2.5 KB
- ooxml/schemas/ecma/fouth-edition/opc-digSig.xsd 2.8 KB
- ooxml/schemas/ecma/fouth-edition/opc-relationships.xsd 1.3 KB
- ooxml/schemas/ISO-IEC29500-4_2016/dml-chart.xsd 73 KB
- ooxml/schemas/ISO-IEC29500-4_2016/dml-chartDrawing.xsd 6.8 KB
- ooxml/schemas/ISO-IEC29500-4_2016/dml-diagram.xsd 50 KB
- ooxml/schemas/ISO-IEC29500-4_2016/dml-lockedCanvas.xsd 624 B
- ooxml/schemas/ISO-IEC29500-4_2016/dml-main.xsd 148 KB
- ooxml/schemas/ISO-IEC29500-4_2016/dml-picture.xsd 1.2 KB
- ooxml/schemas/ISO-IEC29500-4_2016/dml-spreadsheetDrawing.xsd 8.7 KB
- ooxml/schemas/ISO-IEC29500-4_2016/dml-wordprocessingDrawing.xsd 14 KB
- ooxml/schemas/ISO-IEC29500-4_2016/pml.xsd 82 KB
- ooxml/schemas/ISO-IEC29500-4_2016/shared-additionalCharacteristics.xsd 1.2 KB
- ooxml/schemas/ISO-IEC29500-4_2016/shared-bibliography.xsd 7.2 KB
- ooxml/schemas/ISO-IEC29500-4_2016/shared-commonSimpleTypes.xsd 6.2 KB
- ooxml/schemas/ISO-IEC29500-4_2016/shared-customXmlDataProperties.xsd 1.2 KB
- ooxml/schemas/ISO-IEC29500-4_2016/shared-customXmlSchemaProperties.xsd 880 B
- ooxml/schemas/ISO-IEC29500-4_2016/shared-documentPropertiesCustom.xsd 2.5 KB
- ooxml/schemas/ISO-IEC29500-4_2016/shared-documentPropertiesExtended.xsd 3.4 KB
- ooxml/schemas/ISO-IEC29500-4_2016/shared-documentPropertiesVariantTypes.xsd 7.3 KB
- ooxml/schemas/ISO-IEC29500-4_2016/shared-math.xsd 23 KB
- ooxml/schemas/ISO-IEC29500-4_2016/shared-relationshipReference.xsd 1.3 KB
- ooxml/schemas/ISO-IEC29500-4_2016/sml.xsd 237 KB
- ooxml/schemas/ISO-IEC29500-4_2016/vml-main.xsd 26 KB
- ooxml/schemas/ISO-IEC29500-4_2016/vml-officeDrawing.xsd 25 KB
- ooxml/schemas/ISO-IEC29500-4_2016/vml-presentationDrawing.xsd 535 B
- ooxml/schemas/ISO-IEC29500-4_2016/vml-spreadsheetDrawing.xsd 5.6 KB
- ooxml/schemas/ISO-IEC29500-4_2016/vml-wordprocessingDrawing.xsd 3.9 KB
- ooxml/schemas/ISO-IEC29500-4_2016/wml.xsd 167 KB
- ooxml/schemas/ISO-IEC29500-4_2016/xml.xsd 4.5 KB
- ooxml/schemas/mce/mc.xsd 3.1 KB
- ooxml/schemas/microsoft/wml-2010.xsd 26 KB
- ooxml/schemas/microsoft/wml-2012.xsd 3.7 KB
- ooxml/schemas/microsoft/wml-2018.xsd 901 B
- ooxml/schemas/microsoft/wml-cex-2018.xsd 1.7 KB
- ooxml/schemas/microsoft/wml-cid-2016.xsd 1002 B
- ooxml/schemas/microsoft/wml-sdtdatahash-2020.xsd 600 B
- ooxml/schemas/microsoft/wml-symex-2015.xsd 745 B
- ooxml/scripts/pack.py 5.5 KB runs code
- ooxml/scripts/unpack.py 1.0 KB runs code
- ooxml/scripts/validate.py 1.9 KB runs code
- ooxml/scripts/validation/__init__.py 336 B runs code
- ooxml/scripts/validation/base.py 39 KB runs code
- ooxml/scripts/validation/docx.py 9.8 KB runs code
- ooxml/scripts/validation/pptx.py 12 KB runs code
- ooxml/scripts/validation/redlining.py 11 KB runs code
- scripts/__init__.py 65 B runs code
- scripts/document.py 49 KB runs code
- scripts/templates/comments.xml 2.6 KB
- scripts/templates/commentsExtended.xml 2.6 KB
- scripts/templates/commentsExtensible.xml 2.7 KB
- scripts/templates/commentsIds.xml 2.6 KB
- scripts/templates/people.xml 147 B
- scripts/utilities.py 13 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 197 lines · 77 tokens per session scan B 0bd90681fcab
docx is a skill published in the GitHub repository nicepkg/ai-workflow (282 stars, last pushed 7mo ago), licensed MIT. It adds 77 tokens to every session and 2,473 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). It is 98% identical to docx, differing in 3 lines, and is treated as a copy.
Other skills, from other repositories
aatmf-t10-confidentiality-breach
AATMF T10 — Integrity & Confidentiality Breach. System prompt extraction, training-data extraction, model-weight leakage, private-key recovery.
peekaboo
Capture and automate macOS UI with the Peekaboo CLI.
mochi-remind
Handle due reminders — notify the user with natural language and mark them done.
publish-registry
Publish @agentos-software/ registry packages from AgentOS. Use whenever the user asks to publish or release registry software/agent packages.
sidewinder-rattlesnake
Adversary-emulation profile for SideWinder (G0121 / Rattlesnake / T-APT-04 / Razor Tiger), India's suspected state-sponsored cyber-espionage actor.
lazarus-group
Adversary-emulation profile for Lazarus Group (G0032, aka Hidden Cobra / Diamond Sleet / Labyrinth Chollima), a North Korean RGB-linked actor conducting espionage, destructive, and financially motivated operations.