office-docs

Warn

Audited by Gen Agent Trust Hub on May 10, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the subprocess module to execute various system tools necessary for document processing and validation. These include:
  • gcc for compiling a C-based shim library in scripts/office/soffice.py.
  • soffice (LibreOffice) for converting documents to PDF in scripts/thumbnail.py and scripts/office/soffice.py.
  • pdftoppm for converting PDF pages to images for slide thumbnails in scripts/thumbnail.py.
  • git diff for comparing textual changes in Word documents within scripts/office/validators/redlining.py.
  • [REMOTE_CODE_EXECUTION]: A dynamic execution pattern is present in scripts/office/soffice.py. The script contains an embedded C source code string (_SHIM_SOURCE) intended to shim system calls for Unix domain sockets. At runtime, the script writes this source to a temporary directory, compiles it into a shared library using gcc, and configures the environment to inject this library into the soffice process using the LD_PRELOAD environment variable. This allows the skill to intercept and modify core system behaviors (such as socket, listen, and accept) to enable functionality in restricted execution environments.
Audit Metadata
Risk Level
MEDIUM
Analyzed
May 10, 2026, 11:12 AM