xlsx

SUSPICIOUS: the spreadsheet capabilities are coherent and mostly local, but the mandatory recalc.py component is an unverifiable script that executes and sets up LibreOffice macros without source or release provenance in the skill. That supply-chain gap is disproportionate to the otherwise benign documentation-style workflow.

This module is primarily a LibreOffice headless recalculation wrapper, but it also conditionally writes a LibreOffice Basic macro (Module1.xba) into the user’s LibreOffice profile directory and then invokes it via vnd.sun.star.script. That combination (persistent host modification + Office/LibreOffice macro execution) is a strong security red flag for supply-chain risk because the macro payload can potentially execute arbitrary actions in the LibreOffice process context. The provided fragment is incomplete around macro_content, so the exact payload cannot be verified here; treat this as high-risk and require inspection of the actual macro content and packaging process, ideally in a sandbox.