docx
Warn
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs dynamic code compilation and process injection to facilitate document conversion.\n
- In
scripts/office/soffice.py, the script writes a C source file to the temporary directory and compiles it into a shared object (.so) usinggccviasubprocess.run.\n - The resulting library is then injected into the
sofficeprocess using theLD_PRELOADenvironment variable to shim socket functions.\n scripts/accept_changes.pywrites a LibreOffice Basic macro to a temporary profile and executes it via thesofficecommand line to automate document modifications.\n- Several scripts (
accept_changes.py,soffice.py,redlining.py) utilizesubprocess.runto invoke external binaries includinggcc,soffice, andgit.
Audit Metadata