xlsx

Fail

Audited by Gen Agent Trust Hub on Mar 30, 2026

Risk Level: HIGHCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/office/soffice.py contains an embedded C source string (_SHIM_SOURCE) which it writes to a temporary file and compiles at runtime using gcc. The resulting shared object is then loaded into the soffice process using the LD_PRELOAD environment variable. This is a highly advanced technique for modifying process behavior and represents a high-risk dynamic execution pattern.
  • [PERSISTENCE]: The script scripts/recalc.py automatically installs a StarBasic macro into the LibreOffice user configuration directory (e.g., ~/.config/libreoffice/4/user/basic/Standard/Module1.xba). This modification persists across sessions and influences the behavior of the LibreOffice application whenever it is launched by the agent.
  • [COMMAND_EXECUTION]: Several scripts perform arbitrary command execution via subprocess.run():
  • scripts/office/soffice.py executes gcc to compile the shim library.
  • scripts/recalc.py executes soffice with macro invocation arguments, as well as timeout or gtimeout utilities.
  • scripts/office/validators/redlining.py executes git diff to compare document versions.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Mar 30, 2026, 08:58 AM