xlsx

Warn

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/office/soffice.py performs runtime compilation of C source code into a shared library using the system compiler.
  • Evidence: subprocess.run(["gcc", "-shared", "-fPIC", "-o", str(_SHIM_SO), str(src), "-ldl"], ...) in scripts/office/soffice.py.
  • [COMMAND_EXECUTION]: The skill utilizes the LD_PRELOAD environment variable to inject the compiled shared library into the soffice process. While intended to shim socket functionality in sandboxed environments, process injection via LD_PRELOAD is a powerful technique that allows interception of system calls.
  • Evidence: env["LD_PRELOAD"] = str(shim) in scripts/office/soffice.py.
  • [COMMAND_EXECUTION]: The skill modifies the environment by writing a StarBasic macro to the LibreOffice user configuration directory (~/.config/libreoffice/ or ~/Library/Application Support/LibreOffice/). This macro is used to automate the recalculation and saving of spreadsheet files.
  • Evidence: setup_libreoffice_macro function in scripts/recalc.py.
  • [COMMAND_EXECUTION]: The skill executes multiple external CLI tools including soffice, gcc, and git to perform its tasks.
  • Evidence: Various subprocess.run calls in scripts/recalc.py, scripts/office/soffice.py, and scripts/office/validators/redlining.py.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 13, 2026, 05:19 PM