xlsx

Warn

Audited by Socket on Sep 14, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/office/soffice.py

This module conditionally performs runtime native compilation and injects the resulting shared object into the LibreOffice (soffice) subprocess via LD_PRELOAD. While no explicit exfiltration/credential theft is visible in the Python fragment, the injection technique is inherently high-impact and the actual shim behavior cannot be verified because _SHIM_SOURCE is not included. The package should be reviewed by inspecting _SHIM_SOURCE, the emitted .so, and its runtime effects under sandboxed testing before trust is granted.

Confidence: 58%Severity: 78%
Audit Metadata
Analyzed At
Sep 14, 2026, 03:49 PM
Package URL
pkg:socket/skills-sh/k-dense-ai%2Fscientific-agent-skills%2Fxlsx%2F@1f9c93de4733968852e654594d707f3ea0006de52a4c95e432aea13dff02014c
Security Audit — socket — xlsx