xlsx
Warn
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill uses runtime compilation and process injection to modify the behavior of the system's LibreOffice binary.
- File:
scripts/office/soffice.py - Evidence: The script writes C source code (
_SHIM_SOURCE) to a temporary file, compiles it into a shared library usinggcc, and then sets theLD_PRELOADenvironment variable when executingsofficeto intercept and redirect socket system calls. - [PERSISTENCE]: The skill modifies application configuration files to install persistent logic.
- File:
scripts/recalc.py - Evidence: The
setup_libreoffice_macrofunction installs a StarBasic macro (RECALCULATE_MACRO) into theModule1.xbafile within the LibreOffice user profile directory (~/.config/libreofficeon Linux or~/Library/Application Support/LibreOfficeon macOS). This code remains on the system and is accessible to all subsequent LibreOffice sessions. - [INDIRECT_PROMPT_INJECTION]: The skill reads and processes external spreadsheet data and returns cell contents to the agent, creating a surface for indirect injection attacks.
- Ingestion points:
scripts/recalc.pyreads cell values from user-provided spreadsheets usingopenpyxl.load_workbook(data_only=True). The agent is also instructed to usepandas.read_excelinSKILL.md. - Boundary markers: No clear markers or instructions are provided to distinguish between spreadsheet data and agent instructions.
- Capability inventory: The skill can execute various system commands via
subprocess.runand utilizes library injection, providing high-privilege capabilities that could be abused if an injection is successful. - Sanitization: While
defusedxmlis employed for XML safety, the skill does not sanitize the string content of the spreadsheet cells before returning them to the agent's context. - [COMMAND_EXECUTION]: The skill frequently invokes external binaries to perform system tasks.
- Files:
scripts/recalc.py,scripts/office/soffice.py,scripts/office/validators/redlining.py - Evidence: Subprocess calls to
gccfor compilation,sofficefor formula recalculation, andgitfor generating document diffs.
Audit Metadata