xlsx

Warn

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The recalc.py script executes system commands using subprocess.run to call the soffice (LibreOffice) binary and the timeout or gtimeout utility. This is used to trigger headless formula recalculation in Excel files.
  • [DYNAMIC_EXECUTION]: The skill dynamically generates a LibreOffice Basic macro (Module1.xba) from a hardcoded string template and writes it to the local filesystem. It then instructs LibreOffice to execute this generated code using a specific script URI (vnd.sun.star.script:Standard.Module1.RecalculateAndSave).
  • [PERSISTENCE]: The setup_libreoffice_macro function in recalc.py creates or modifies files in the user's application configuration directory (~/.config/libreoffice/ on Linux or ~/Library/Application Support/LibreOffice/ on macOS). This modification to the LibreOffice environment persists across sessions and affects the application's global state.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Excel files, creating a potential surface for indirect prompt injection.
  • Ingestion points: Spreadsheet data is loaded into the agent's context using pd.read_excel() and load_workbook() in both SKILL.md and recalc.py.
  • Boundary markers: No explicit markers or "ignore" instructions are used to separate untrusted cell data from the agent's core instructions.
  • Capability inventory: The skill possesses file-writing capabilities (wb.save) and command execution via the recalc.py script.
  • Sanitization: The skill performs no sanitization or filtering of spreadsheet content, only verifying the absence of functional Excel errors like #REF! or #DIV/0!.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 9, 2026, 03:42 AM