skills/cdeistopened/skill-stack/xlsx/Gen Agent Trust Hub

xlsx

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The recalc.py script executes soffice (LibreOffice) and timeout/gtimeout via subprocess.run(). These calls are used for the legitimate purpose of recalculating Excel formulas and are protected by basic path validation. The command construction uses static strings and local file paths rather than untrusted user input.- [EXTERNAL_DOWNLOADS]: The skill mentions the requirement of LibreOffice but does not perform any automatic downloads of software or binary payloads from external servers. References to SEC EDGAR and Bloomberg in SKILL.md are provided as examples of data sourcing for financial modeling documentation.- [DATA_EXPOSURE]: The skill interacts with local .xlsx, .csv, and .tsv files as instructed by the user. There are no patterns indicating unauthorized file access to sensitive system locations or hardcoded credentials. User-provided data is processed locally using standard data science libraries.- [PROMPT_INJECTION]: The instructions contain phrases like 'CRITICAL' and 'IMPORTANT', but these are used for providing technical requirements (e.g., 'Use Formulas, Not Hardcoded Values') rather than attempting to bypass AI safety guardrails or override system prompts.- [CODE_QUALITY]: The Python code in recalc.py follows best practices for cross-platform compatibility (macOS/Linux) and includes error handling for file existence and macro configuration. The use of load_workbook(data_only=True) to check for Excel errors is a standard verification technique.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 12:33 PM
Security Audit — agent-trust-hub — xlsx