Skills docx
📦
docx
Content revision r1 Safe 🌐 Network access📁 Filesystem access⚙️ External commands
Edit DOCX Documents Reliably
Professional Word documents often need precise edits, comments, and tracked changes without breaking formatting. This skill gives Claude, Codex, and Claude Code structured DOCX workflows with OOXML tools and validation steps.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "docx" from https://skillstore.io/skills/docx.md and its manifest at https://skillstore.io/api/skills/docx/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "docx". A user provides a policy DOCX and asks for a review copy with comments on ambiguous requirements.
Expected outcome:
- A revised DOCX file with comments anchored to the relevant paragraphs.
- A short summary listing each comment and the reason it was added.
- A validation note confirming the document was repacked successfully.
Using "docx". A user asks for a quarterly report DOCX based on a markdown outline and chart image.
Expected outcome:
- A formatted Word document with title, sections, table, image, and page layout.
- A brief build summary describing included styles and inserted assets.
Using "docx". A user requests contract edits with tracked changes for dates, party names, and payment terms.
Expected outcome:
- A redlined DOCX file with precise insertions and deletions.
- A checklist of completed edits grouped by document section.
- A verification summary based on converted markdown or validation output.
Security Audit
Safev11 • 7/9/2026 Open versioned report
The confirmed risks are expected for a DOCX manipulation skill: local file operations, ZIP package handling, temporary workspaces, subprocess calls, and privileged dependency installation guidance. Most static findings are false positives from OOXML namespace URIs, schema imports, Markdown code formatting, compact XML templates, or validation identifiers. No prompt injection attempt was found in the reviewed skill files. Static review was capped at 400/450 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
59
Files scanned
24,725
Lines analyzed
48
Review items
0
False positives ignored
Capability review items (48)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Archive extract all (zip slip risk)
zipfile.ZipFile(input_file).extractall(output_path)
The script extracts Office ZIP contents from user-provided documents with extractall, which can write outside the target directory if entries contain traversal paths.
High
Archive extract all (zip slip risk)
zip_ref.extractall(temp_path)
The script extracts Office ZIP contents from user-provided documents with extractall, which can write outside the target directory if entries contain traversal paths.
High
Archive extract all (zip slip risk)
zip_ref.extractall(temp_dir)
The script extracts Office ZIP contents from user-provided documents with extractall, which can write outside the target directory if entries contain traversal paths.
High
Archive extract all (zip slip risk)
zip_ref.extractall(temp_path)
The script extracts Office ZIP contents from user-provided documents with extractall, which can write outside the target directory if entries contain traversal paths.
High
Python subprocess.run
result = subprocess.run(
The helper invokes local external programs with subprocess.run for validation or diff generation.
High
Python subprocess.run
result = subprocess.run(
The helper invokes local external programs with subprocess.run for validation or diff generation.
High
Python subprocess.run
result = subprocess.run(
The helper invokes local external programs with subprocess.run for validation or diff generation.
High
sudo privilege escalation
- **pandoc**: `sudo apt-get install pandoc` (for text extraction)
The skill documentation recommends sudo apt-get installation commands, which require elevated privileges.
High
sudo privilege escalation
- **LibreOffice**: `sudo apt-get install libreoffice` (for PDF conversion)
The skill documentation recommends sudo apt-get installation commands, which require elevated privileges.
High
sudo privilege escalation
- **Poppler**: `sudo apt-get install poppler-utils` (for pdftoppm to convert PDF to images)
The skill documentation recommends sudo apt-get installation commands, which require elevated privileges.
Medium
Node.js fs operations
Packer.toBuffer(doc).then(buffer => fs.writeFileSync("doc.docx", buffer)); // Node.js
The docx-js workflow explicitly reads or writes local files when creating DOCX files or embedding images.
Medium
Node.js fs operations
data: fs.readFileSync("image.png"),
The docx-js workflow explicitly reads or writes local files when creating DOCX files or embedding images.
Medium
Python archive libraries
import zipfile
The skill intentionally reads or writes DOCX package ZIP archives as part of document workflows.
Medium
Python archive libraries
with zipfile.ZipFile(output_file, "w", zipfile.ZIP_DEFLATED) as zf:
The skill intentionally reads or writes DOCX package ZIP archives as part of document workflows.
Medium
Python archive libraries
import zipfile
The skill intentionally reads or writes DOCX package ZIP archives as part of document workflows.
Medium
Python archive libraries
zipfile.ZipFile(input_file).extractall(output_path)
The skill intentionally reads or writes DOCX package ZIP archives as part of document workflows.
Medium
Python archive libraries
import zipfile
The skill intentionally reads or writes DOCX package ZIP archives as part of document workflows.
Medium
Python archive libraries
with zipfile.ZipFile(self.original_file, "r") as zip_ref:
The skill intentionally reads or writes DOCX package ZIP archives as part of document workflows.
Medium
Python archive libraries
import zipfile
The skill intentionally reads or writes DOCX package ZIP archives as part of document workflows.
Medium
Python archive libraries
with zipfile.ZipFile(self.original_file, "r") as zip_ref:
The skill intentionally reads or writes DOCX package ZIP archives as part of document workflows.
Medium
Python archive libraries
import zipfile
The skill intentionally reads or writes DOCX package ZIP archives as part of document workflows.
Medium
Python archive libraries
with zipfile.ZipFile(self.original_docx, "r") as zip_ref:
The skill intentionally reads or writes DOCX package ZIP archives as part of document workflows.
Medium
Python file write/append
with open(xml_file, "wb") as f:
The helper writes modified XML content back to files during packing.
Medium
Python os file operations
os.makedirs(media_dir, exist_ok=True)
The documentation shows creating directories while modifying DOCX package contents.
Medium
Python shutil operations
shutil.copy('image.png', os.path.join(media_dir, 'image1.png'))
The helper copies or removes document working directories as part of edit and save workflows.
Medium
Python shutil operations
shutil.copytree(input_dir, temp_content_dir)
The helper copies or removes document working directories as part of edit and save workflows.
Medium
Python shutil operations
shutil.copytree(self.original_path, self.unpacked_path)
The helper copies or removes document working directories as part of edit and save workflows.
Medium
Python shutil operations
shutil.rmtree(self.temp_dir)
The helper copies or removes document working directories as part of edit and save workflows.
Medium
Python shutil operations
shutil.copytree(self.unpacked_path, target_path, dirs_exist_ok=True)
The helper copies or removes document working directories as part of edit and save workflows.
Medium
Python shutil operations
shutil.copy(TEMPLATE_DIR / "people.xml", path)
The helper copies or removes document working directories as part of edit and save workflows.
Medium
Python shutil operations
shutil.copy(TEMPLATE_DIR / "comments.xml", self.comments_path)
The helper copies or removes document working directories as part of edit and save workflows.
Medium
Python shutil operations
shutil.copy(
The helper copies or removes document working directories as part of edit and save workflows.
Medium
Python shutil operations
shutil.copy(TEMPLATE_DIR / "commentsIds.xml", self.comments_ids_path)
The helper copies or removes document working directories as part of edit and save workflows.
Medium
Python shutil operations
shutil.copy(
The helper copies or removes document working directories as part of edit and save workflows.
Medium
Synchronous file operations
Packer.toBuffer(doc).then(buffer => fs.writeFileSync("doc.docx", buffer)); // Node.js
The docx-js workflow reads or writes local files while creating DOCX output.
Medium
Synchronous file operations
data: fs.readFileSync("image.png"),
The docx-js workflow reads or writes local files while creating DOCX output.
Low
Temp file creation
import tempfile
The helpers create temporary working directories for document packing and validation.
Low
Temp file creation
with tempfile.TemporaryDirectory() as temp_dir:
The helpers create temporary working directories for document packing and validation.
Low
Temp file creation
with tempfile.TemporaryDirectory() as temp_dir:
The helpers create temporary working directories for document packing and validation.
Low
Temp file creation
import tempfile
The helpers create temporary working directories for document packing and validation.
Low
Temp file creation
with tempfile.TemporaryDirectory() as temp_dir:
The helpers create temporary working directories for document packing and validation.
Low
Temp file creation
import tempfile
The helpers create temporary working directories for document packing and validation.
Low
Temp file creation
with tempfile.TemporaryDirectory() as temp_dir:
The helpers create temporary working directories for document packing and validation.
Low
Temp file creation
import tempfile
The helpers create temporary working directories for document packing and validation.
Low
Temp file creation
with tempfile.TemporaryDirectory() as temp_dir:
The helpers create temporary working directories for document packing and validation.
Low
Temp file creation
with tempfile.TemporaryDirectory() as temp_dir:
The helpers create temporary working directories for document packing and validation.
Low
Temp file creation
import tempfile
The helpers create temporary working directories for document packing and validation.
Low
Temp file creation
self.temp_dir = tempfile.mkdtemp(prefix="docx_")
The helpers create temporary working directories for document packing and validation.
Risk Factors
🌐 Network access (50)
docx-js.md:240 ooxml.md:166 ooxml.md:167 ooxml.md:187 ooxml.md:188 ooxml.md:189 ooxml.md:231 ooxml.md:232 ooxml.md:465 ooxml.md:477 ooxml.md:478 ooxml.md:479 ooxml/schemas/ecma/fouth-edition/opc-contentTypes.xsd:2 ooxml/schemas/ecma/fouth-edition/opc-contentTypes.xsd:4 ooxml/schemas/ecma/fouth-edition/opc-coreProperties.xsd:2 ooxml/schemas/ecma/fouth-edition/opc-coreProperties.xsd:3 ooxml/schemas/ecma/fouth-edition/opc-coreProperties.xsd:4 ooxml/schemas/ecma/fouth-edition/opc-coreProperties.xsd:5 ooxml/schemas/ecma/fouth-edition/opc-coreProperties.xsd:7 ooxml/schemas/ecma/fouth-edition/opc-coreProperties.xsd:8 ooxml/schemas/ecma/fouth-edition/opc-coreProperties.xsd:9 ooxml/schemas/ecma/fouth-edition/opc-coreProperties.xsd:10 ooxml/schemas/ecma/fouth-edition/opc-digSig.xsd:2 ooxml/schemas/ecma/fouth-edition/opc-digSig.xsd:4 ooxml/schemas/ecma/fouth-edition/opc-relationships.xsd:2 ooxml/schemas/ecma/fouth-edition/opc-relationships.xsd:4 ooxml/schemas/ISO-IEC29500-4_2016/dml-chart.xsd:3 ooxml/schemas/ISO-IEC29500-4_2016/dml-chart.xsd:4 ooxml/schemas/ISO-IEC29500-4_2016/dml-chart.xsd:5 ooxml/schemas/ISO-IEC29500-4_2016/dml-chart.xsd:6 ooxml/schemas/ISO-IEC29500-4_2016/dml-chart.xsd:7 ooxml/schemas/ISO-IEC29500-4_2016/dml-chart.xsd:8 ooxml/schemas/ISO-IEC29500-4_2016/dml-chart.xsd:10 ooxml/schemas/ISO-IEC29500-4_2016/dml-chart.xsd:12 ooxml/schemas/ISO-IEC29500-4_2016/dml-chart.xsd:14 ooxml/schemas/ISO-IEC29500-4_2016/dml-chart.xsd:16 ooxml/schemas/ISO-IEC29500-4_2016/dml-chartDrawing.xsd:3 ooxml/schemas/ISO-IEC29500-4_2016/dml-chartDrawing.xsd:4 ooxml/schemas/ISO-IEC29500-4_2016/dml-chartDrawing.xsd:5 ooxml/schemas/ISO-IEC29500-4_2016/dml-chartDrawing.xsd:7 ooxml/schemas/ISO-IEC29500-4_2016/dml-diagram.xsd:3 ooxml/schemas/ISO-IEC29500-4_2016/dml-diagram.xsd:4 ooxml/schemas/ISO-IEC29500-4_2016/dml-diagram.xsd:5 ooxml/schemas/ISO-IEC29500-4_2016/dml-diagram.xsd:6 ooxml/schemas/ISO-IEC29500-4_2016/dml-diagram.xsd:7 ooxml/schemas/ISO-IEC29500-4_2016/dml-diagram.xsd:9 ooxml/schemas/ISO-IEC29500-4_2016/dml-diagram.xsd:11 ooxml/schemas/ISO-IEC29500-4_2016/dml-diagram.xsd:13 ooxml/schemas/ISO-IEC29500-4_2016/dml-lockedCanvas.xsd:3 ooxml/schemas/ISO-IEC29500-4_2016/dml-lockedCanvas.xsd:4
📁 Filesystem access (50)
docx-js.md:20 docx-js.md:265 docx-js.md:20 docx-js.md:265 ooxml.md:280 ooxml.md:456 ooxml.md:455 ooxml/schemas/ISO-IEC29500-4_2016/wml.xsd:12 ooxml/schemas/microsoft/wml-2010.xsd:3 ooxml/schemas/microsoft/wml-2012.xsd:2 ooxml/schemas/microsoft/wml-2012.xsd:3 ooxml/schemas/microsoft/wml-2018.xsd:2 ooxml/schemas/microsoft/wml-cex-2018.xsd:3 ooxml/schemas/microsoft/wml-cex-2018.xsd:4 ooxml/schemas/microsoft/wml-cid-2016.xsd:2 ooxml/schemas/microsoft/wml-sdtdatahash-2020.xsd:2 ooxml/schemas/microsoft/wml-symex-2015.xsd:2 ooxml/scripts/pack.py:22 ooxml/scripts/pack.py:46 ooxml/scripts/pack.py:13 ooxml/scripts/pack.py:65 ooxml/scripts/pack.py:101 ooxml/scripts/pack.py:154 ooxml/scripts/pack.py:67 ooxml/scripts/pack.py:15 ooxml/scripts/pack.py:76 ooxml/scripts/unpack.py:7 ooxml/scripts/unpack.py:17 ooxml/scripts/unpack.py:17 ooxml/scripts/validate.py:25 ooxml/scripts/validation/base.py:347 ooxml/scripts/validation/base.py:349 ooxml/scripts/validation/base.py:878 ooxml/scripts/validation/base.py:886 ooxml/scripts/validation/base.py:879 ooxml/scripts/validation/base.py:890 ooxml/scripts/validation/base.py:891 ooxml/scripts/validation/docx.py:6 ooxml/scripts/validation/docx.py:198 ooxml/scripts/validation/docx.py:7 ooxml/scripts/validation/docx.py:200 ooxml/scripts/validation/docx.py:201 ooxml/scripts/validation/pptx.py:272 ooxml/scripts/validation/redlining.py:6 ooxml/scripts/validation/redlining.py:64 ooxml/scripts/validation/redlining.py:142 ooxml/scripts/validation/redlining.py:7 ooxml/scripts/validation/redlining.py:69 ooxml/scripts/validation/redlining.py:70 scripts/document.py:32
⚙️ External commands (49)
ooxml/scripts/pack.py:103 ooxml/scripts/validation/redlining.py:153 ooxml/scripts/validation/redlining.py:185 SKILL.md:36-40 SKILL.md:40-46 SKILL.md:46-49 SKILL.md:49-50 SKILL.md:50-51 SKILL.md:51-52 SKILL.md:52 SKILL.md:59-68 SKILL.md:68-69 SKILL.md:69-71 SKILL.md:71-82 SKILL.md:82-85 SKILL.md:85-91 SKILL.md:91-96 SKILL.md:96-98 SKILL.md:98-116 SKILL.md:116-117 SKILL.md:117-132 SKILL.md:132 SKILL.md:134 SKILL.md:136-139 SKILL.md:139-141 SKILL.md:141-145 SKILL.md:145-147 SKILL.md:147-149 SKILL.md:149-152 SKILL.md:152-161 SKILL.md:161-163 SKILL.md:163-166 SKILL.md:166-168 SKILL.md:168-169 SKILL.md:169 SKILL.md:172-173 SKILL.md:173 SKILL.md:174 SKILL.md:175 SKILL.md:176-179 SKILL.md:179-181 SKILL.md:181-193 SKILL.md:193-194 SKILL.md:194-195 SKILL.md:195-196 SKILL.md:196-197 SKILL.md:193 SKILL.md:195 SKILL.md:196
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/docx/audits/11?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/docx?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/docx?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/docx/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/docx.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
anthropics. (2026). docx security audit report (audit version 11) [Author version unspecified]. Skillstore. https://skillstore.io/skills/docx/audits/11BibTeX citation
@techreport{anthropics-docx-2026,
author = {anthropics},
title = {docx security audit report (audit version 11)},
institution = {Skillstore},
year = {2026},
number = {11},
url = {https://skillstore.io/skills/docx/audits/11},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "docx security audit report (audit version 11)"
version: "unspecified"
type: report
authors:
- name: "anthropics"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/docx/audits/11"
identifiers:
- type: other
value: "skillstore:docx:audit:11"
description: "Skillstore immutable audit report identifier"
Compare variants
11 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Highest Skillstore Score
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
7Spade Recommended
7spade-docx
Skillstore Score 76
Evidence Confidence High
Skillstore usage 83
Updated
2026-09-09
zhanlincui-docx
Skillstore Score 75
Evidence Confidence High
Skillstore usage 657
Updated
2026-09-09
anthropics Current
docx
Skillstore Score 75
Evidence Confidence High
Skillstore usage 184
Updated
2026-09-09
cam10001110101-docx
Skillstore Score 75
Evidence Confidence High
Skillstore usage 42
Updated
2026-09-09
composiohq-docx
Skillstore Score 75
Evidence Confidence High
Skillstore usage 20
Updated
2026-09-09
sickn33-docx
Skillstore Score 75
Evidence Confidence Medium
Skillstore usage 37
Updated
2026-09-09
k-dense-ai-docx
Skillstore Score 75
Evidence Confidence Medium
Skillstore usage 25
Updated
2026-09-09
davila7-docx
Skillstore Score 75
Evidence Confidence Medium
Skillstore usage 14
Updated
2026-09-09
dyai2025-docx
Skillstore Score 75
Evidence Confidence Medium
Skillstore usage 12
Updated
2026-09-09
artemisai-docx
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 46
Updated
2026-09-09
azeem-2-docx
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 13
Updated
2026-09-09
Skillstore Score
Why this score Evidence Confidence: High 45
Architecture
85
Maintainability
87
Content
75
Community
83
Spec Compliance
What You Can Build
Review a Contract with Tracked Changes
Apply focused edits, preserve unchanged text, and produce a DOCX with professional tracked changes.
Generate a Styled Report
Create a new Word document with headings, tables, images, headers, footers, and consistent styles.
Inspect Document Structure
Unpack a DOCX file, review XML relationships, extract text, and verify comments or embedded media.
Try These Prompts
Extract Document Text
Extract the text from this DOCX file and summarize the headings, key sections, and any tracked changes.
Create a Word Document
Create a DOCX report from this outline. Include a title page, heading styles, a table, page numbers, and a short appendix.
Add Review Comments
Open this DOCX file, add comments to unclear or risky sections, and return a reviewed copy with the original text preserved.
Apply Tracked Contract Edits
Review this agreement and apply the requested clause changes as tracked changes. Use minimal edits, validate the DOCX, and report each changed section.
Best Practices
- Read the relevant workflow file fully before creating, editing, or redlining a document.
- Work in small batches for tracked changes and validate after each meaningful group of edits.
- Keep a separate original copy so final validation can compare document structure and text.
Avoid
- Do not replace whole paragraphs when only a few words need tracked changes.
- Do not rely on markdown line numbers to locate XML nodes in Word documents.
- Do not skip validation after direct OOXML edits or relationship changes.
Frequently Asked Questions
Can this skill create a new DOCX file?
Yes. It uses docx-js guidance to create Word documents with text, styles, tables, images, and page layout.
Can it edit an existing Word document?
Yes. It can unpack a DOCX file, edit OOXML content, add comments, and repack the result.
Does it support tracked changes?
Yes. It includes a redlining workflow for precise insertions and deletions with validation guidance.
What dependencies may be needed?
Some workflows need pandoc, docx, LibreOffice, Poppler, defusedxml, Python, or Node.js.
Can it preserve formatting?
It is designed to preserve DOCX structure, but complex formatting should be checked in Word after validation.
Does it send documents to a network service?
No network service is required by the included scripts. It works with local files and local document tools.
Developer Details
Author
anthropicsLicense
Proprietary. LICENSE.txt has complete terms
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
0519034dad657fb1f7706e0550e962beeda73fdf
Maintenance freshness
7/18/2026
Usage
173 downloads · 354 views
File structure
📁 ooxml/
📁 schemas/
📁 ecma/
📄 dml-wordprocessingDrawing.xsd
📄 pml.xsd
📄 shared-additionalCharacteristics.xsd
📄 shared-commonSimpleTypes.xsd
📄 shared-customXmlDataProperties.xsd
📄 shared-customXmlSchemaProperties.xsd
📄 shared-documentPropertiesCustom.xsd
📄 shared-documentPropertiesExtended.xsd
📄 shared-documentPropertiesVariantTypes.xsd
📄 shared-relationshipReference.xsd
📄 sml.xsd
📄 vml-wordprocessingDrawing.xsd
📄 wml.xsd
📄 xml.xsd
📁 mce/
📄 mc.xsd
📁 scripts/
📄 pack.py
📄 base.py
📄 docx.py
📄 pptx.py
📄 ooxml.md
📁 scripts/
📄 SKILL.md