xlsx

SUSPICIOUS: the skill’s spreadsheet capabilities are well aligned with its stated purpose and it does not request credentials or route data to external services, but it requires execution of an undocumented recalc.py script that auto-configures LibreOffice macros. Because that executable component is unverifiable from the provided evidence, the skill carries high supply-chain risk despite otherwise proportionate behavior.