xlsx
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes system binaries and dynamic code generation to facilitate its core document processing functionality.
- The script
scripts/office/soffice.pydynamically writes a hardcoded C source file and compiles it usinggccinto a shared library. This library is then injected into the LibreOffice process via theLD_PRELOADenvironment variable to shim socket calls, ensuring the tool works in sandboxed environments. - The skill executes
soffice(LibreOffice) to perform headless formula recalculation and error scanning within spreadsheets. - It uses the
gitbinary to perform word-level diffing between document versions to validate that changes are correctly recorded. - [COMMAND_EXECUTION]: The skill processes untrusted external data from spreadsheet files (.xlsx, .csv, .tsv), which constitutes an indirect prompt injection surface. The skill mitigates common risks associated with this surface by employing security-hardened XML parsing libraries such as
defusedxmlto prevent XML-based attacks during file processing.
Audit Metadata