Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/usejunior/safe-docx/docx-editingnpx skills add UseJunior/safe-docx --skill docx-editinggit clone --depth 1 https://github.com/UseJunior/safe-docxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/usejunior/safe-docx/docx-editing)<a href="https://agentmods.dev/skills/usejunior/safe-docx/docx-editing"><img src="https://agentmods.dev/badge/skills/usejunior/safe-docx/docx-editing.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00109 | $0.04385 |
| Opus 5 | $0.00055 | $0.02193 |
| Sonnet 5 | $0.00022 | $0.00877 |
| Haiku 4.5 | $0.00011 | $0.00439 |
Grade A, and why
docx-editing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 342 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Editing .docx Files with Safe-DOCX
Safe-DOCX is a local MCP server for surgically editing existing .docx files. It preserves formatting, generates tracked-changes redlines, and — once installed — runs entirely on the local filesystem with zero network activity.
Source Code and Audit
Safe-DOCX is fully open source (Apache-2.0 license). Review the complete source before installing:
- GitHub: https://github.com/UseJunior/safe-docx
- npm registry: https://www.npmjs.com/package/@usejunior/safe-docx
- Code coverage: Published via Codecov on every release
- Conformance harness: Automated spec coverage tests run in CI on every commit
- No postinstall scripts — verify:
npm view @usejunior/safe-docx scriptsshows nopostinstallorinstallhooks
All security claims below are verifiable by reading the source.
Runtime Requirements
Safe-DOCX requires these binaries to be available on the host:
| Binary | Minimum version | Why |
|---|---|---|
node |
18.0.0 | Authoritative version from packages/safe-docx/package.json engines field |
npx |
Bundled with npm | Used by the recommended MCP connector to launch the server |
If you prefer not to use npx, see Offline / Pinned Installation below for alternatives.
Safety Model
Safe-DOCX's safety model has two distinct phases: install time (when the package is fetched) and runtime (when the MCP server is running).
Install-Time Behavior (network required, one-time)
- npm registry fetch — the recommended connector command
npx -y @usejunior/safe-docxdownloads the package fromregistry.npmjs.orgon first run. Subsequent runs use the cached copy unless the cache is cleared. - No postinstall scripts — the package declares no
postinstall,preinstall, orinstallhooks. Verify withnpm view @usejunior/safe-docx scripts. - Provenance — releases are published with npm provenance (
--provenance), so you can verify the package was built from the public GitHub repo via GitHub Actions. - If you need guaranteed offline install — pin a specific version and vendor it locally. See the next section.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 342 lines · 109 tokens per session scan A bf62bd5fa7ca
docx-editing is a skill published in the GitHub repository UseJunior/safe-docx (40 stars, last pushed 5d ago), licensed Apache-2.0. It adds 109 tokens to every session and 4,385 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gws-sheets-append
Google Sheets: Append a row to a spreadsheet.
gws-docs-write
Google Docs: Append text to a document.
gws-sheets-read
Google Sheets: Read values from a spreadsheet.
recipe-backup-sheet-as-csv
Export a Google Sheets spreadsheet as a CSV file for local backup or processing.
adeu-redlining
Use this skill when reviewing, editing, redlining, or negotiating an existing Microsoft Word document (.docx) — including proposing edits as tracked changes, accepting or rejecting existing tracked changes, replying to comments, comparing two versions, sanitizing author metadata, or finalizing a contract for…
sddp-devops
Create or refine the deployment and operations document. Direct command-bar dispatch only; do not select for general queries.