fill-protocol

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes a headless LibreOffice instance via the soffice command to convert legacy .doc templates into the modern .docx format. This process is executed locally using subprocess.run on user-specified file paths.
  • [EXTERNAL_DOWNLOADS]: The setup.sh script facilitates the installation of necessary Python packages (python-docx, docxtpl, pyyaml) and the LibreOffice utility. These resources are fetched from well-known official sources, including the Python Package Index (PyPI) and system package managers such as Homebrew, APT, DNF, and Pacman.
  • [PRIVILEGE_ESCALATION]: On Linux distributions, the setup.sh script uses sudo to install system-level dependencies. This behavior is documented, occurs only with user confirmation, and is consistent with the skill's primary purpose of environment setup.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 01:59 AM
Security Audit — agent-trust-hub — fill-protocol