skills/aidotnet/opencowork/xlsx/Gen Agent Trust Hub

xlsx

Pass

Audited by Gen Agent Trust Hub on Apr 14, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script recalc.py uses subprocess.run to invoke the soffice (LibreOffice) binary. This is a legitimate functional requirement for the skill's stated purpose of recalculating Excel formulas, as openpyxl does not have a built-in formula engine. The command construction uses a list of arguments rather than a raw shell string, reducing injection risks.
  • [EXTERNAL_DOWNLOADS]: The skill mentions the requirement for openpyxl, pandas, and LibreOffice. These are standard, well-known industry tools for the task. The recalc.py script manages local LibreOffice macro configuration but does not perform untrusted remote downloads.
  • [DATA_EXFILTRATION]: No network-based exfiltration patterns or unauthorized data access commands were found. The tool operates on local Excel files provided by the user.
  • [PROMPT_INJECTION]: The SKILL.md contains strong internal instructions to prevent formula errors and maintain professional formatting, but does not contain patterns attempting to bypass agent safety filters or override system-level constraints.
  • [DYNAMIC_EXECUTION]: The skill uses recalc.py to trigger a LibreOffice macro. While this involves automation of another application, the macro code is statically defined within the script and used solely for the calculateAll and store functions.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 14, 2026, 09:19 AM