pptx

Warn

Audited by Socket on Oct 1, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/office/soffice.py

This module conditionally performs runtime native compilation and injects the resulting shared object into the LibreOffice (soffice) subprocess via LD_PRELOAD. While no explicit exfiltration/credential theft is visible in the Python fragment, the injection technique is inherently high-impact and the actual shim behavior cannot be verified because _SHIM_SOURCE is not included. The package should be reviewed by inspecting _SHIM_SOURCE, the emitted .so, and its runtime effects under sandboxed testing before trust is granted.

Confidence: 58%Severity: 78%
Audit Metadata
Analyzed At
Oct 1, 2026, 04:24 PM
Package URL
pkg:socket/skills-sh/k-dense-ai%2Fscientific-agent-skills%2Fpptx%2F@a7d1224ad0e9fa67dd8cb02361ad115b539b36eee9628acc07f0a941869a7ae4