xlsx
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
recalc.pyusessubprocess.runto invoke thesoffice(LibreOffice) binary. This is a legitimate functional requirement for the skill's stated purpose of recalculating Excel formulas, asopenpyxldoes not have a built-in formula engine. The command construction uses a list of arguments rather than a raw shell string, reducing injection risks. - [EXTERNAL_DOWNLOADS]: The skill mentions the requirement for
openpyxl,pandas, andLibreOffice. These are standard, well-known industry tools for the task. Therecalc.pyscript manages local LibreOffice macro configuration but does not perform untrusted remote downloads. - [DATA_EXFILTRATION]: No network-based exfiltration patterns or unauthorized data access commands were found. The tool operates on local Excel files provided by the user.
- [PROMPT_INJECTION]: The
SKILL.mdcontains strong internal instructions to prevent formula errors and maintain professional formatting, but does not contain patterns attempting to bypass agent safety filters or override system-level constraints. - [DYNAMIC_EXECUTION]: The skill uses
recalc.pyto trigger a LibreOffice macro. While this involves automation of another application, the macro code is statically defined within the script and used solely for thecalculateAllandstorefunctions.
Audit Metadata