The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to execute external commands, primarily invoking LibreOffice (soffice) and the timeout utility. This behavior is implemented in scripts/_soffice.py, scripts/pivot_table.py, and scripts/recalc.py. While used for legitimate automation, it involves passing user-influenced parameters like filenames and sheet names to the system shell.
[REMOTE_CODE_EXECUTION]: The scripts scripts/pivot_table.py and scripts/recalc.py perform dynamic code generation and execution (Category 10). They construct StarBasic macros from templates, write them to the local filesystem (LibreOffice's application support directory), and then trigger their execution via command-line arguments. This mechanism allows the skill to execute arbitrary logic within the LibreOffice runtime environment, bypassing standard library constraints.
[REMOTE_CODE_EXECUTION]: The skill modifies the LibreOffice macro library by writing to Module1.xba in the user's configuration directory (e.g., ~/.config/libreoffice/...). This modification persists across sessions, effectively installing executable code in the user's application environment that could be leveraged by other processes.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) as it processes potentially untrusted external data from Excel workbooks.
Ingestion points: Workbook files are opened and parsed in scripts/pivot_table.py and scripts/recalc.py using the openpyxl and pandas libraries.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to disregard embedded instructions within the spreadsheet content.
Capability inventory: The skill possesses significant system capabilities, including filesystem manipulation, archive extraction (zipfile), and the execution of shell commands and application macros.
Sanitization: While the _esc function performs basic escaping for StarBasic string literals, the skill lacks comprehensive validation for all user-supplied metadata fields before they are interpolated into executable templates.

xlsx