docx
Warn
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/office/soffice.pyexecutesgccviasubprocess.runto compile an embedded C source string into a shared library at runtime. It then utilizes this library via theLD_PRELOADenvironment variable to intercept socket system calls when executing thesoffice(LibreOffice) binary. This is a form of process injection. - [COMMAND_EXECUTION]: The script
scripts/accept_changes.pydynamically generates a LibreOffice Basic macro and writes it to a temporary application profile before executing it through thesofficecommand line. This allows for automated acceptance of tracked changes using internal LibreOffice functions. - [COMMAND_EXECUTION]: Multiple scripts throughout the skill, such as
scripts/office/pack.py,ooxml/scripts/pack.py, andscripts/office/validators/redlining.py, invoke external system binaries includingsoffice,git, and Poppler'spdftoppmto perform document conversion, validation, and diffing. - [COMMAND_EXECUTION]: Documentation within
SKILL.mdand related files instructs the agent to perform various shell operations, includingunzip,zip, andfindcommands, often involving files provided by external parties.
Audit Metadata