xlsx
Pass
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
recalc.pyscript executes thesoffice(LibreOffice) binary and system timeout commands usingsubprocess.run. These calls use list-based arguments, which is a secure practice to prevent shell injection.\n- [DYNAMIC_EXECUTION]: The skill generates a LibreOffice Basic macro at runtime and writes it to the user's local configuration directory (e.g.,~/.config/libreoffice/or~/Library/Application Support/LibreOffice/). This is a functional requirement for triggering formula recalculation within the spreadsheet environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external Excel files (.xlsx, .csv, .tsv), which presents a surface for potential instruction injection through spreadsheet content.\n - Ingestion points: Files are read via
openpyxlandpandasas described in the documentation andrecalc.py.\n - Boundary markers: None identified in the provided instructions.\n
- Capability inventory: The skill has the ability to execute shell commands (via
recalc.py) and modify local files.\n - Sanitization: No explicit sanitization of spreadsheet data is performed before processing.
Audit Metadata