xlsx

Pass

Audited by Gen Agent Trust Hub on Apr 15, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The recalc.py script executes the soffice (LibreOffice) binary and system timeout commands using subprocess.run. These calls use list-based arguments, which is a secure practice to prevent shell injection.\n- [DYNAMIC_EXECUTION]: The skill generates a LibreOffice Basic macro at runtime and writes it to the user's local configuration directory (e.g., ~/.config/libreoffice/ or ~/Library/Application Support/LibreOffice/). This is a functional requirement for triggering formula recalculation within the spreadsheet environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external Excel files (.xlsx, .csv, .tsv), which presents a surface for potential instruction injection through spreadsheet content.\n
  • Ingestion points: Files are read via openpyxl and pandas as described in the documentation and recalc.py.\n
  • Boundary markers: None identified in the provided instructions.\n
  • Capability inventory: The skill has the ability to execute shell commands (via recalc.py) and modify local files.\n
  • Sanitization: No explicit sanitization of spreadsheet data is performed before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 15, 2026, 06:10 PM
Security Audit — agent-trust-hub — xlsx