docx
Warn
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several external system binaries using Python's
subprocessmodule for document processing and validation. scripts/accept_changes.pyandscripts/office/soffice.pyinvokesoffice(LibreOffice) to perform document conversions and track-change acceptance.scripts/office/validators/redlining.pyinvokesgitto generate word diffs for content validation.scripts/office/soffice.pyinvokesgccto compile a C source file into a shared object library at runtime.- [REMOTE_CODE_EXECUTION]:
scripts/office/soffice.pyimplements a process injection technique to modify the runtime behavior of LibreOffice. - The script dynamically generates C source code and compiles it into a shared library (
lo_socket_shim.so) in the temporary directory. - It uses the
LD_PRELOADenvironment variable to force the loading of this shared library into thesofficeprocess. This technique is used to intercept and override standard socket system calls (likesocket,listen, andaccept) to bypass AF_UNIX socket restrictions often found in sandboxed environments.
Audit Metadata