docx

Warn

Audited by Gen Agent Trust Hub on Mar 31, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill frequently executes external system binaries via subprocess.run(). Notable instances include calling soffice for document conversion, git for generating validation diffs, and gcc for compilation.
  • [DYNAMIC_EXECUTION]: scripts/office/soffice.py contains a C source string that is written to a temporary file and compiled at runtime using gcc. The resulting shared object (.so) is injected into the LibreOffice process using the LD_PRELOAD environment variable to shim socket communications.
  • [DYNAMIC_EXECUTION]: scripts/accept_changes.py programmatically generates a LibreOffice Basic macro and saves it to a temporary user profile. This macro is then executed via a specialized URI scheme (vnd.sun.star.script) to perform batch operations on documents.
  • [EXTERNAL_DOWNLOADS]: Documentation in SKILL.md instructs the user or agent to install the docx package globally from the NPM registry (npm install -g docx).
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 31, 2026, 08:21 AM
Security Audit — agent-trust-hub — docx