skills/huangzida/skills/xlsx/Gen Agent Trust Hub

xlsx

Warn

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill uses runtime compilation and process injection to modify the behavior of the system's LibreOffice binary.
  • File: scripts/office/soffice.py
  • Evidence: The script writes C source code (_SHIM_SOURCE) to a temporary file, compiles it into a shared library using gcc, and then sets the LD_PRELOAD environment variable when executing soffice to intercept and redirect socket system calls.
  • [PERSISTENCE]: The skill modifies application configuration files to install persistent logic.
  • File: scripts/recalc.py
  • Evidence: The setup_libreoffice_macro function installs a StarBasic macro (RECALCULATE_MACRO) into the Module1.xba file within the LibreOffice user profile directory (~/.config/libreoffice on Linux or ~/Library/Application Support/LibreOffice on macOS). This code remains on the system and is accessible to all subsequent LibreOffice sessions.
  • [INDIRECT_PROMPT_INJECTION]: The skill reads and processes external spreadsheet data and returns cell contents to the agent, creating a surface for indirect injection attacks.
  • Ingestion points: scripts/recalc.py reads cell values from user-provided spreadsheets using openpyxl.load_workbook(data_only=True). The agent is also instructed to use pandas.read_excel in SKILL.md.
  • Boundary markers: No clear markers or instructions are provided to distinguish between spreadsheet data and agent instructions.
  • Capability inventory: The skill can execute various system commands via subprocess.run and utilizes library injection, providing high-privilege capabilities that could be abused if an injection is successful.
  • Sanitization: While defusedxml is employed for XML safety, the skill does not sanitize the string content of the spreadsheet cells before returning them to the agent's context.
  • [COMMAND_EXECUTION]: The skill frequently invokes external binaries to perform system tasks.
  • Files: scripts/recalc.py, scripts/office/soffice.py, scripts/office/validators/redlining.py
  • Evidence: Subprocess calls to gcc for compilation, soffice for formula recalculation, and git for generating document diffs.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 6, 2026, 04:21 PM