Skip to content
Back to skills

Docx

ASecurity

Create, read, edit, or convert Microsoft Word documents while preserving professional document structure. Use when a .docx file is a primary input or requested output, including tracked changes, comments, images, headings, page furniture, or polished reports and letters. Not for PDFs, spreadsheets, Google Docs, or unrelated coding tasks.

  • 144 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added September 23, 2026
ai-agentsjavascriptpythongojavabashnode

Security analysis

A92/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro scans all 18 files and shows the line behind each finding

Scanned September 23, 2026

npx -y skills add flonat/flonat-research --skill docx --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Docx?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Docx
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/flonat-docx/badge)](https://www.skillsdirectory.com/skills/flonat-docx)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: docx
description: "Create, read, edit, or convert Microsoft Word documents while preserving professional document structure. Use when a .docx file is a primary input or requested output, including tracked changes, comments, images, headings, page furniture, or polished reports and letters. Not for PDFs, spreadsheets, Google Docs, or unrelated coding tasks."
license: Proprietary. LICENSE.txt has complete terms
allowed-tools: Bash(uv*, pandoc*, node*, npx*, mkdir*, ls*), Read, Write, Edit
---

# DOCX creation, editing, and analysis

## Overview

A .docx file is a ZIP archive containing XML files.

## Quick Reference

| Task | Approach |
|------|----------|
| Read/analyze content | `pandoc` or unpack for raw XML |
| Create new document | Use `docx-js` — see [`references/docx-js-patterns.md`](references/docx-js-patterns.md) |
| Edit existing document | Unpack → edit XML → repack — see Editing below |

### Converting .doc to .docx

```bash
uv run python scripts/office/soffice.py --headless --convert-to docx document.doc
```

### Reading Content

```bash
# Text extraction with tracked changes
pandoc --track-changes=all document.docx -o output.md

# Raw XML access
uv run python scripts/office/unpack.py document.docx unpacked/
```

### Converting to Images

```bash
uv run python scripts/office/soffice.py --headless --convert-to pdf document.docx
pdftoppm -jpeg -r 150 document.pdf page
```

### Accepting Tracked Changes

```bash
uv run python scripts/accept_changes.py input.docx output.docx
```

---

## Creating New Documents

Generate .docx files with JavaScript using `docx-js`. Install: `npm install -g docx`

Full code patterns (setup, page size, styles, lists, tables, images, hyperlinks, footnotes, tab stops, multi-column layouts, TOC, headers/footers): [`references/docx-js-patterns.md`](references/docx-js-patterns.md)

### Critical Rules for docx-js

- **Set page size explicitly** — defaults to A4; use US Letter (12240 x 15840 DXA) for US documents
- **Landscape: pass portrait dimensions** — docx-js swaps width/height internally
- **Never use `\n`** — use separate Paragraph elements
- **Never use unicode bullets** — use `LevelFormat.BULLET` with numbering config
- **PageBreak must be in Paragraph** — standalone creates invalid XML
- **ImageRun requires `type`** — always specify png/jpg/etc
- **Always set table `width` with DXA** — never use `WidthType.PERCENTAGE` (breaks in Google Docs)
- **Tables need dual widths** — `columnWidths` array AND cell `width`, both must match
- **Use `ShadingType.CLEAR`** — never SO[Project] for table shading
- **Never use tables as dividers** — use border on Paragraph instead; for two-column footers, use tab stops
- **TOC requires HeadingLevel only** — no custom styles on heading paragraphs
- **Override built-in styles** — use exact IDs: "Heading1", "Heading2", etc.
- **Include `outlineLevel`** — required for TOC (0 for H1, 1 for H2, etc.)

### Validation

```bash
uv run python scripts/office/validate.py doc.docx
```

---

## Editing Existing Documents

**Follow all 3 steps in order.**

### Step 1: Unpack
```bash
uv run python scripts/office/unpack.py document.docx unpacked/
```
Extracts XML, pretty-prints, merges adjacent runs, and converts smart quotes to XML entities. Use `--merge-runs false` to skip run merging.

### Step 2: Edit XML

Edit files in `unpacked/word/`. **Use "Claude" as the author** for tracked changes and comments.

**Use the Edit tool directly for string replacement. Do not write Python scripts.**

**Use smart quotes for new content:**
| Entity | Character |
|--------|-----------|
| `‘` | ' (left single) |
| `’` | ' (right single / apostrophe) |
| `“` | " (left double) |
| `”` | " (right double) |

**Adding comments:**
```bash
uv run python scripts/comment.py unpacked/ 0 "Comment text with & and ’"
uv run python scripts/comment.py unpacked/ 1 "Reply text" --parent 0
```
Then add markers to document.xml.

Full XML patterns (tracked changes, comments, images): [`references/xml-reference.md`](references/xml-reference.md)

### Step 3: Pack
```bash
uv run python scripts/office/pack.py unpacked/ output.docx --original document.docx
```
Validates with auto-repair, condenses XML, and creates DOCX. Use `--validate false` to skip.

### Common Pitfalls

- **Replace entire `<w:r>` elements**: When adding tracked changes, replace the whole `<w:r>...</w:r>` block with `<w:del>...<w:ins>...` as siblings.
- **Preserve `<w:rPr>` formatting**: Copy the original run's `<w:rPr>` block into your tracked change runs.

---

## Dependencies

- **pandoc**: Text extraction
- **docx**: `npm install -g docx` (new documents)
- **LibreOffice**: PDF conversion (auto-configured via `scripts/office/soffice.py`)
- **Poppler**: `pdftoppm` for images

Files in this skill

  • LICENSE.txt1.4 KB
  • SKILL.md4.7 KB
  • references/docx-js-patterns.md9.3 KB
  • references/xml-reference.md3.9 KB
  • scripts/__init__.py1 B
  • scripts/accept_changes.py4 KB
  • scripts/comment.py10.4 KB
  • scripts/office/helpers/merge_runs.py5.4 KB
  • scripts/office/helpers/simplify_redlines.py5.6 KB
  • scripts/office/pack.py4.9 KB
  • scripts/office/schemas/ISO-IEC29500-4_2016/dml-chart.xsd73.2 KB
  • scripts/office/schemas/ISO-IEC29500-4_2016/dml-chartDrawing.xsd6.8 KB
  • scripts/office/schemas/ISO-IEC29500-4_2016/dml-diagram.xsd50.1 KB
  • scripts/office/schemas/ISO-IEC29500-4_2016/dml-lockedCanvas.xsd624 B
  • scripts/office/schemas/ISO-IEC29500-4_2016/dml-picture.xsd1.2 KB
  • scripts/office/schemas/ISO-IEC29500-4_2016/dml-spreadsheetDrawing.xsd8.7 KB
  • scripts/office/schemas/ISO-IEC29500-4_2016/dml-wordprocessingDrawing.xsd14.4 KB
  • scripts/office/schemas/ISO-IEC29500-4_2016/pml.xsd81.7 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.