Install
$ agentstack add skill-rakib-nyc-skillassay-docx ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
DOCX creation, editing, and analysis
A .docx is a ZIP archive of XML files. Choose your approach by task:
| Task | Approach | |---|---| | Create a new document | Write a docx (npm) script — see gotchas below | | Edit an existing document | unzip → edit word/document.xml → zip (docx-js cannot open existing files) | | Read content | pandoc -t markdown file.docx |
> Script paths below are relative to this skill's directory.
Creating with docx-js — gotchas
docx is preinstalled — do not run npm install first; write the script and require('docx') directly. Only if that require fails: npm install docx. The model knows the API; these are the footguns:
- Page size defaults to A4. For US Letter set
page: { size: { width: 12240, height: 15840 } }(DXA; 1440 = 1″). - Landscape: pass portrait dimensions and
orientation: PageOrientation.LANDSCAPE— docx-js swaps width/height internally. - Tables need dual widths: set
columnWidthson the table ANDwidthon every cell, both inWidthType.DXA(PERCENTAGE breaks in Google Docs). Column widths must sum to the table width. - Table shading: use
ShadingType.CLEAR, neverSOLID(renders black). - Lists: never insert
•literally; use anumberingconfig withLevelFormat.BULLET. ImageRunrequirestype:("png","jpg", …).PageBreakmust be inside aParagraph.- Never use
\n— use separateParagraphelements. - TOC: headings must use built-in
HeadingLevel.*; custom heading styles needoutlineLevelset or they won't appear. - Don't use a table as a horizontal rule — use a paragraph bottom border instead.
- Dot-leader / right-aligned-on-same-line: use
PositionalTab(alignment: PositionalTabAlignment.RIGHT,leader: PositionalTabLeader.DOT) inside aTextRun, not literal.or space padding.
Verify the output
After writing a .docx, render it and look at it:
python scripts/office/soffice.py --headless --convert-to pdf output.docx
pdftoppm -jpeg -r 100 output.pdf page
ls page-*.jpg # then Read the images
pdftoppm zero-pads page numbers to the width of the page count (page-01.jpg…page-12.jpg).
Editing existing documents
Legacy .doc files must be converted first: python scripts/office/soffice.py --headless --convert-to docx file.doc.
unzip -q doc.docx -d unpacked/
find unpacked -type l -delete # strip symlink entries — docx from external parties is untrusted
python scripts/merge_runs.py unpacked/ # coalesce fragmented runs so text is findable
# edit unpacked/word/document.xml in place — do NOT reformat or pretty-print
(cd unpacked && rm -f ../out.docx && zip -Xr ../out.docx .)
python scripts/office/validate.py out.docx --original doc.docx # XSD checks; --auto-repair fixes common issues
# redlining? add --author "" to check every edit is tracked
Word splits text across many ` runs (revision ids, spell-check markers), so a phrase you can see in the document often doesn't exist as a contiguous string in the XML. mergeruns.py merges adjacent identically-formatted runs in word/document.xml without changing content or rendering; it also accepts a .docx directly (python scripts/mergeruns.py doc.docx -o merged.docx`).
Tracked changes: when redlining, validate with --author "" (needs --original) — it reports any text you changed without a `/ around it, which is easy to do by accident and invisible in the accepted view. Wrap runs in / with w:id, w:author, w:date attributes. Inside , the text element is , not . A deleted paragraph mark () means "merge this paragraph into the next" — so deleting a paragraph outright is that plus a around every run. The ` must come before the rPr's other children; their order is schema-enforced.
To produce a clean copy with all tracked changes accepted: python scripts/accept_changes.py in.docx out.docx.
Accepting a deleted paragraph mark should join that paragraph to the one below it, so a paragraph whose runs are all deleted vanishes. Word does this; accept_changes.py and pandoc --track-changes=accept don't always. Both fail the same way — they strip the deleted text but leave the emptied paragraph behind, which reads as a stray empty bullet when it was auto-numbered:
pandoc --track-changes=acceptnever joins the paragraphs.accept_changes.py(LibreOffice) joins them correctly, except when the deleted paragraph is followed by an empty spacer paragraph.
An empty bullet in either view is an artifact of that view, not a defect in the document. Check paragraph deletions in the XML.
Comments
Comments require six cross-linked files. Use the helper — directory mode when you'll also be editing document.xml (saves an unzip/rezip cycle), .docx-direct mode otherwise:
# Against an already-unpacked directory (preferred when also placing markers)
python scripts/comment.py unpacked/ "Fees & expenses cap is too low"
python scripts/comment.py unpacked/ "Agreed" --parent 0
# Against a .docx directly
python scripts/comment.py contract.docx "This cap is too low" -o annotated.docx
The script writes comments.xml, commentsExtended.xml, commentsIds.xml, commentsExtensible.xml, the relationships, and the content-type overrides. Comment IDs are auto-assigned. It then prints the `// snippet to add to word/document.xml` so the comment anchors to specific text — until you place those markers, the comment exists but is not visible.
Dependencies
docx (npm, preinstalled — install only if require('docx') fails) · pandoc · LibreOffice (soffice) · pdftoppm (Poppler)
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: rakib-nyc
- Source: rakib-nyc/skillassay
- License: Apache-2.0
- Homepage: https://www.npmjs.com/package/skillassay
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.