docx — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited docx (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You already know Word's features. This skill adds what you can't see from the code: a library that makes tracked changes and comments correctly, validation that catches untracked edits, a way to see pages as a reader will, and the docx-js and OOXML behaviours that silently produce broken files.
<skill> is the directory containing this file. Run bundled scripts by absolute path from the user's working directory, so relative paths to their files keep working:
uv run <skill>/ooxml/scripts/unpack.py contract.docx unpackedRun Python you write with its dependencies declared, either uv run --with defusedxml script.py or a PEP 723 header. Run Node scripts as NODE_PATH=<skill>/node_modules node build.js; if <skill>/node_modules is missing, run npm install in <skill> once. Rendering pages needs LibreOffice (soffice) and poppler (pdftoppm); reading needs pandoc.
| Task | Use |
|---|---|
| Read the text | pandoc --track-changes=all file.docx -t markdown. It also shows tracked changes and comments. Use accept or reject instead of all to see either outcome. |
| Create a document | docx-js: read docx-js.md first. It covers the page size, style and image behaviours that otherwise break the file. |
| Edit someone else's document, or anything legal, academic, business or official | Tracked changes, so every edit is reviewable: the redlining workflow below. |
| Small edits to a document you created in this session | The same library, untracked. Make the edits, then call doc.save(require_tracking=False), which still checks the schema. For larger changes, regenerate the file with docx-js. |
| Comments, metadata, embedded media, raw structure | Unpack and read the XML; ooxml.md has the patterns. |
uv run <skill>/ooxml/scripts/unpack.py contract.docx unpacked prints a suggested RSID. Pass it as Document(..., rsid=...) so the session's edits share one revision ID.Document library. tracked_replace(old, new) handles most edits: it finds text across runs and marks only the words that differ. Work in batches of related changes, a few to a dozen per script, so a failure is easy to locate. Grep unpacked/word/document.xml again before each batch, because line numbers move after every save.doc.save() refuses to write a document with untracked edits, or with XML that breaks the schema, and prints what differs. Fix the script rather than skipping validation.uv run <skill>/ooxml/scripts/pack.py unpacked reviewed.docx repacks the file and checks that LibreOffice can open it.pandoc --track-changes=all reviewed.docx -t markdown and confirm every intended change appears and nothing else changed. Then check the output (below).To accept or reject existing changes, call doc.accept_all_changes() or doc.reject_all_changes() before making edits of your own.
uv run <skill>/ooxml/scripts/validate.py reviewed.docx --original contract.docx checks the schema, and that every change from the original is tracked; doc.save() runs the same checks. Pass --author NAME to let that author's earlier insertions be edited directly. For a document generated from scratch, leave out --original to check the schema alone.uv run <skill>/ooxml/scripts/render.py reviewed.docx pages prints one PNG path per page (--pages 2-4 for a range). Read them before delivering a document you created or restructured. LibreOffice renders a docx-js table of contents empty; Word fills it in when it opens the file.<w:del> inside it. Never edit their text directly.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.