Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/snyk/agent-scan/docxnpx skills add snyk/agent-scan --skill docxgit clone --depth 1 https://github.com/snyk/agent-scanWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/snyk/agent-scan/docx)<a href="https://agentmods.dev/skills/snyk/agent-scan/docx"><img src="https://agentmods.dev/badge/skills/snyk/agent-scan/docx.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00077 | $0.02473 |
| Opus 5 | $0.00039 | $0.01236 |
| Sonnet 5 | $0.00015 | $0.00495 |
| Haiku 4.5 | $0.00008 | $0.00247 |
Grade B, and why
docx scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- **pandoc**: `sudo apt-get install pandoc` (for text extraction) This is a copy
98% identical to docx — 2 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 198 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DOCX creation, editing, and analysis
Overview
A user may ask you to create, edit, or analyze the contents of a .docx file. A .docx file is essentially a ZIP archive containing XML files and other resources that you can read or edit. You have different tools and workflows available for different tasks.
Workflow Decision Tree
Reading/Analyzing Content
Use "Text extraction" or "Raw XML access" sections below
Creating New Document
Use "Creating a new Word document" workflow
Editing Existing Document
-
Your own document + simple changes Use "Basic OOXML editing" workflow
-
Someone else's document Use "Redlining workflow" (recommended default)
-
Legal, academic, business, or government docs Use "Redlining workflow" (required)
Reading and analyzing content
Text extraction
If you just need to read the text contents of a document, you should convert the document to markdown using pandoc. Pandoc provides excellent support for preserving document structure and can show tracked changes:
# Convert document to markdown with tracked changes
pandoc --track-changes=all path-to-file.docx -o output.md
# Options: --track-changes=accept/reject/all
Raw XML access
You need raw XML access for: comments, complex formatting, document structure, embedded media, and metadata. For any of these features, you'll need to unpack a document and read its raw XML contents.
Unpacking a file
python ooxml/scripts/unpack.py <office_file> <output_directory>
Key file structures
word/document.xml- Main document contentsword/comments.xml- Comments referenced in document.xmlword/media/- Embedded images and media files- Tracked changes use
<w:ins>(insertions) and<w:del>(deletions) tags
Creating a new Word document
When creating a new Word document from scratch, use docx-js, which allows you to create Word documents using JavaScript/TypeScript.
Workflow
- MANDATORY - READ ENTIRE FILE: Read
docx-js.md(~500 lines) completely from start to finish. NEVER set any range limits when reading this file. Read the full file content for detailed syntax, critical formatting rules, and best practices before proceeding with document creation. - Create a JavaScript/TypeScript file using Document, Paragraph, TextRun components (You can assume all dependencies are installed, but if not, refer to the dependencies section below)
- Export as .docx using Packer.toBuffer()
What ships with it
58 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- docx-js.md 16 KB
- LICENSE.txt 1.4 KB
- ooxml.md 23 KB
- ooxml/schemas/ecma/fouth-edition/opc-contentTypes.xsd 1.9 KB
- ooxml/schemas/ecma/fouth-edition/opc-coreProperties.xsd 2.5 KB
- ooxml/schemas/ecma/fouth-edition/opc-digSig.xsd 2.8 KB
- ooxml/schemas/ecma/fouth-edition/opc-relationships.xsd 1.3 KB
- ooxml/schemas/ISO-IEC29500-4_2016/dml-chart.xsd 73 KB
- ooxml/schemas/ISO-IEC29500-4_2016/dml-chartDrawing.xsd 6.8 KB
- ooxml/schemas/ISO-IEC29500-4_2016/dml-diagram.xsd 50 KB
- ooxml/schemas/ISO-IEC29500-4_2016/dml-lockedCanvas.xsd 624 B
- ooxml/schemas/ISO-IEC29500-4_2016/dml-main.xsd 148 KB
- ooxml/schemas/ISO-IEC29500-4_2016/dml-picture.xsd 1.2 KB
- ooxml/schemas/ISO-IEC29500-4_2016/dml-spreadsheetDrawing.xsd 8.7 KB
- ooxml/schemas/ISO-IEC29500-4_2016/dml-wordprocessingDrawing.xsd 14 KB
- ooxml/schemas/ISO-IEC29500-4_2016/pml.xsd 82 KB
- ooxml/schemas/ISO-IEC29500-4_2016/shared-additionalCharacteristics.xsd 1.2 KB
- ooxml/schemas/ISO-IEC29500-4_2016/shared-bibliography.xsd 7.2 KB
- ooxml/schemas/ISO-IEC29500-4_2016/shared-commonSimpleTypes.xsd 6.2 KB
- ooxml/schemas/ISO-IEC29500-4_2016/shared-customXmlDataProperties.xsd 1.2 KB
- ooxml/schemas/ISO-IEC29500-4_2016/shared-customXmlSchemaProperties.xsd 880 B
- ooxml/schemas/ISO-IEC29500-4_2016/shared-documentPropertiesCustom.xsd 2.5 KB
- ooxml/schemas/ISO-IEC29500-4_2016/shared-documentPropertiesExtended.xsd 3.4 KB
- ooxml/schemas/ISO-IEC29500-4_2016/shared-documentPropertiesVariantTypes.xsd 7.3 KB
- ooxml/schemas/ISO-IEC29500-4_2016/shared-math.xsd 23 KB
- ooxml/schemas/ISO-IEC29500-4_2016/shared-relationshipReference.xsd 1.3 KB
- ooxml/schemas/ISO-IEC29500-4_2016/sml.xsd 237 KB
- ooxml/schemas/ISO-IEC29500-4_2016/vml-main.xsd 26 KB
- ooxml/schemas/ISO-IEC29500-4_2016/vml-officeDrawing.xsd 25 KB
- ooxml/schemas/ISO-IEC29500-4_2016/vml-presentationDrawing.xsd 535 B
- ooxml/schemas/ISO-IEC29500-4_2016/vml-spreadsheetDrawing.xsd 5.6 KB
- ooxml/schemas/ISO-IEC29500-4_2016/vml-wordprocessingDrawing.xsd 3.9 KB
- ooxml/schemas/ISO-IEC29500-4_2016/wml.xsd 167 KB
- ooxml/schemas/ISO-IEC29500-4_2016/xml.xsd 4.5 KB
- ooxml/schemas/mce/mc.xsd 3.1 KB
- ooxml/schemas/microsoft/wml-2010.xsd 26 KB
- ooxml/schemas/microsoft/wml-2012.xsd 3.7 KB
- ooxml/schemas/microsoft/wml-2018.xsd 901 B
- ooxml/schemas/microsoft/wml-cex-2018.xsd 1.7 KB
- ooxml/schemas/microsoft/wml-cid-2016.xsd 1002 B
- ooxml/schemas/microsoft/wml-sdtdatahash-2020.xsd 600 B
- ooxml/schemas/microsoft/wml-symex-2015.xsd 745 B
- ooxml/scripts/pack.py 5.4 KB runs code
- ooxml/scripts/unpack.py 1.0 KB runs code
- ooxml/scripts/validate.py 1.9 KB runs code
- ooxml/scripts/validation/__init__.py 336 B runs code
- ooxml/scripts/validation/base.py 37 KB runs code
- ooxml/scripts/validation/docx.py 9.2 KB runs code
- ooxml/scripts/validation/pptx.py 11 KB runs code
- ooxml/scripts/validation/redlining.py 11 KB runs code
- scripts/__init__.py 65 B runs code
- scripts/document.py 49 KB runs code
- scripts/templates/comments.xml 2.6 KB
- scripts/templates/commentsExtended.xml 2.6 KB
- scripts/templates/commentsExtensible.xml 2.7 KB
- scripts/templates/commentsIds.xml 2.6 KB
- scripts/templates/people.xml 148 B
- scripts/utilities.py 13 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 198 lines · 77 tokens per session scan B f63920be5bf2
docx is a skill published in the GitHub repository snyk/agent-scan (2,993 stars, last pushed 2d ago), licensed Apache-2.0. It adds 77 tokens to every session and 2,473 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). It is 98% identical to docx, differing in 2 lines, and is treated as a copy.
Other skills, from other repositories
当用户需要对PDF文件进行任何操作时,请使用此技能。包括从 PDF 中读取或提取文本/表格、合并多个 PDF、拆分 PDF、旋转页面、添加水印、创建新PDF、填写PDF表单、加密/解密 PDF、提取图片,以及对扫描版 PDF 进行 OCR 使其可搜索。如果用户提到 .pdf 文件或要求生成 PDF,请使用此技能。.
pptx
当涉及到 .pptx 文件的任何操作时使用此技能——无论是作为输入、输出还是两者兼有。包括:创建幻灯片、演示文稿或路演材料;读取、解析或提取任何 .pptx 文件中的文本(即使提取的内容将用于其他地方,如邮件或摘要);编辑、修改或更新现有演示文稿;合并或拆分幻灯片文件;处理模板、布局、演讲者备注或批注。当用户提到“演示文稿”、”幻灯片“、”PPT“或引用 .pptx 文件名时触发,无论他们之后打算如何使用内容。如果需要打开、创建或操作 .pptx 文件,就使用此技能。.
adk-unit-design
Writes an as-built architecture document for one ADK code unit — purpose, execution flow, data flow, cross-class dependencies, extension points, and the parts that must not change — to docs/design/{topic}/{unit}/index.md. It describes the code as implemented, not a proposed design, and its reader is a developer about…
nano-pdf
Edits PDF files using natural-language instructions via the nano-pdf CLI. Supports modifying text, changing titles, fixing typos, and updating content on specific pages. Use when the user wants to edit a PDF, modify PDF content, update PDF text, fix a typo in a PDF, change a PDF title, or rewrite part of a PDF page.
hive.pdf
Read, write, merge, split, rotate, watermark, encrypt, and OCR PDF files using Python (pypdf, pdfplumber, reportlab, pypdfium2) and command-line tools (poppler-utils, qpdf). Use when the user asks to extract text/tables/images from a PDF, create or modify a PDF, combine or split PDFs, OCR a scanned PDF…
pdf-toolkit
Structured .pdf operations: extract text/tables, merge pages from multiple PDFs, split a PDF by page ranges, fill PDF form fields, and generate fresh PDFs from JSON. Trigger when the user wants programmatic PDF work without natural-language rewriting — examples: pull tables from a report, combine three PDFs, extract…