docx
Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files) or Word templates (.dotx files). Triggers i…
它会碰到什么
逐条看命中(11 条严重或高危)
- 高
ooxml/scripts/pack.py:103exec-spawnresult = subprocess.run(
- 高
ooxml/scripts/validation/redlining.py:153exec-spawnresult = subprocess.run(
- 高
ooxml/scripts/validation/redlining.py:185exec-spawnresult = subprocess.run(
- 高
scripts/accept_changes.py:68exec-spawnresult = subprocess.run(
- 高
scripts/accept_changes.py:99exec-spawnsubprocess.run(
- 高
scripts/office/soffice.py:29cred-envreadenv["SAL_USE_VCLPLUGIN"] = "svp"
- 高
scripts/office/soffice.py:33cred-envreadenv["LD_PRELOAD"] = str(shim)
- 高
scripts/office/soffice.py:46exec-spawnreturn subprocess.run(["soffice"] + args, env=get_soffice_env(), **kwargs)
- 高
scripts/office/soffice.py:68exec-spawnsubprocess.run(
- 高
scripts/office/validators/redlining.py:192exec-spawnresult = subprocess.run(
- 高
scripts/office/validators/redlining.py:221exec-spawnresult = subprocess.run(
这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。
技能内容
DOCX creation, editing, and analysis
A .docx is a ZIP archive of XML files. Choose your approach by task:
| Task | Approach |
|---|---|
| Create a new document | Write a docx (npm) script — see gotchas below |
| Edit an existing document | unzip → edit word/document.xml → zip (docx-js cannot open existing files) |
| Read content | pandoc -t markdown file.docx |
> Script paths below are relative to this skill's directory.
Creating with docx-js — gotchas
docx is preinstalled — do not run npm install first; write the script and require('docx') directly. Only if that require fails: npm install docx. The model knows the API; these are the footguns:
- Page size defaults to A4. For US Letter set
page: { size: { width: 12240, height: 15840 } }(DXA; 1440 = 1″). - Landscape: pass portrait dimensions and
orientation: PageOrientation.LANDSCAPE— docx-js swaps width/height internally. - Tables need dual widths: set
columnWidthson the table ANDwidthon every cell, both inWidthType.DXA(PERCENTAGE breaks in Google Docs). Column widths must sum to the table width. - Table shading: use
ShadingType.CLEAR, neverSOLID(renders black). - Lists: never insert
•literally; use anumberingconfig withLevelFormat.BULLET. ImageRunrequirestype:("png","jpg", …).PageBreakmust be inside aParagraph.- Never use
\n— use separateParagraphelements. - TOC: headings must use built-in
HeadingLevel.*; custom heading styles needoutlineLevelset or they won't appear. - Don't use a table as a horizontal rule — use a paragraph bottom border instead.
- Dot-leader / right-aligned-on-same-line: use
PositionalTab(alignment: PositionalTabAlignment.RIGHT,leader: PositionalTabLeader.DOT) inside aTextRun, not literal.or space padding.
Verify the output
After writing a .docx, render it and look at it:
python scripts/office/soffice.py --headless --convert-to pdf output.docx
pdftoppm -jpeg -r 100 output.pdf page
ls page-*.jpg # then Read the images
pdftoppm zero-pads page numbers to the width of the page count (page-01.jpg…page-12.jpg).
Editing existing documents
Legacy .doc files must be converted first: python scripts/office/soffice.py --headless --convert-to docx file.doc.
unzip -q doc.docx -d unpacked/
find unpacked -type l -delete # strip symlink entries — docx from external parties is untrusted
python scripts/merge_runs.py unpacked/ # coalesce fragmented runs so text is findable
# edit unpacked/word/document.xml in place — do NOT reformat or pretty-print
(cd unpacked && rm -f ../out.docx && zip -Xr ../out.docx .)
python scripts/office/validate.py out.docx --original doc.docx # XSD checks; --auto-repair fixes common issues
# redlining? add --author "<the name you redlined under>" to check every edit is tracked
Word splits text across many <w:r> runs (revision ids, spell-check markers), so a phrase you can see in the document often doesn't exist as a contiguous string in the XML. merge_runs.py merges adjacent identically-formatted runs in word/document.xml without changing content or rendering; it also accepts a .docx directly (python scripts/merge_runs.py doc.docx -o merged.docx).
Tracked changes: when redlining, validate with --author "<the name you redlined under>" (needs --original) — it reports any text you changed without a <w:ins>/<w:del> around it, which is easy to do by accident and invisible in the accepted view. Wrap runs in <w:ins>/<w:del> with w:id, w:author, w:date attributes. Inside <w:del>, the text element is <w:delText>, not <w:t>. A deleted paragraph mark (<w:pPr><w:rPr><w:del w:id=".." w:author=".." w:date=".."/></w:rPr></w:pPr>) means "merge this paragraph into the next" — so deleting a paragraph outright is that plus a <w:del> around every run. The <w:del/> must come before the rPr's other children; their order is schema-enforced.
To produce a clean copy with all tracked changes accepted: python scripts/accept_changes.py in.docx out.docx.
Accepting a deleted paragraph mark should join that paragraph to the one below it, so a paragraph whose runs are all deleted vanishes. Word does this; accept_changes.py and pandoc --track-changes=accept don't always. Both fail the same way — they strip the deleted text but leave the emptied paragraph behind, which reads as a stray empty bullet when it was auto-numbered:
pandoc --track-changes=acceptnever joins the paragraphs.accept_changes.py(LibreOffice) joins them correctly, except when the deleted paragraph is followed by an empty spacer paragraph.
An empty bullet in either view is an artifact of that view, not a defect in the document. Check paragraph deletions in the XML.
Comments
Comments require six cross-linked files. Use the helper — directory mode when you'll also be editing document.xml (saves an unzip/rezip cycle), .docx-direct mode otherwise:
# Against an already-unpacked directory (preferred when also placing markers)
python scripts/comment.py unpacked/ "Fees & expenses cap is too low"
python scripts/comment.py unpacked/ "Agreed" --parent 0
# Against a .docx directly
python scripts/comment.py contract.docx "This cap is too low" -o annotated.docx
The script writes comments.xml, commentsExtended.xml, commentsIds.xml, commentsExtensible.xml, the relationships, and the content-type overrides. Comment IDs are auto-assigned. It then prints the <w:commentRangeStart>/<w:commentRangeEnd>/<w:commentReference> snippet to add to word/document.xml so the comment anchors to specific text — until you place those markers, the comment exists but is not visible.
Dependencies
docx (npm, preinstalled — install only if require('docx') fails) · pandoc · LibreOffice (soffice) · pdftoppm (Poppler)
想直接用这个技能?
本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。