xlsx
Warn
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/office/soffice.pyperforms runtime compilation of C source code into a shared library using the system compiler. - Evidence:
subprocess.run(["gcc", "-shared", "-fPIC", "-o", str(_SHIM_SO), str(src), "-ldl"], ...)inscripts/office/soffice.py. - [COMMAND_EXECUTION]: The skill utilizes the
LD_PRELOADenvironment variable to inject the compiled shared library into thesofficeprocess. While intended to shim socket functionality in sandboxed environments, process injection via LD_PRELOAD is a powerful technique that allows interception of system calls. - Evidence:
env["LD_PRELOAD"] = str(shim)inscripts/office/soffice.py. - [COMMAND_EXECUTION]: The skill modifies the environment by writing a StarBasic macro to the LibreOffice user configuration directory (
~/.config/libreoffice/or~/Library/Application Support/LibreOffice/). This macro is used to automate the recalculation and saving of spreadsheet files. - Evidence:
setup_libreoffice_macrofunction inscripts/recalc.py. - [COMMAND_EXECUTION]: The skill executes multiple external CLI tools including
soffice,gcc, andgitto perform its tasks. - Evidence: Various
subprocess.runcalls inscripts/recalc.py,scripts/office/soffice.py, andscripts/office/validators/redlining.py.
Audit Metadata