minimax-xlsx
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
subprocess.run()inxlsx_insert_row.pyandlibreoffice_recalc.py. These calls are used to execute local utility scripts included with the skill and the LibreOffice binary (soffice) to perform headless formula recalculation. These operations are restricted to local processing and are essential for the skill's functionality. - [EXTERNAL_DOWNLOADS]: The skill instructions and scripts reference the installation and use of
pandasandLibreOffice. These are well-known technology tools and office suites from established organizations, and their use for spreadsheet processing is standard practice. - [SAFE]: The script
xlsx_unpack.pyincludes specific security logic to detect and block Zip-slip (path traversal) attacks by validating that extracted file paths do not escape the designated target directory. This is a proactive security measure. - [SAFE]: The skill's architectural choice to use surgical XML editing instead of high-level libraries like
openpyxlfor modification is a technical decision intended to preserve complex file components such as VBA macros and pivot tables, which are often lost during library round-trips.
Audit Metadata