xlsx
Fail
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: HIGHCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/office/soffice.pycontains an embedded C source string (_SHIM_SOURCE) which it writes to a temporary file and compiles at runtime usinggcc. The resulting shared object is then loaded into thesofficeprocess using theLD_PRELOADenvironment variable. This is a highly advanced technique for modifying process behavior and represents a high-risk dynamic execution pattern. - [PERSISTENCE]: The script
scripts/recalc.pyautomatically installs a StarBasic macro into the LibreOffice user configuration directory (e.g.,~/.config/libreoffice/4/user/basic/Standard/Module1.xba). This modification persists across sessions and influences the behavior of the LibreOffice application whenever it is launched by the agent. - [COMMAND_EXECUTION]: Several scripts perform arbitrary command execution via
subprocess.run(): scripts/office/soffice.pyexecutesgccto compile the shim library.scripts/recalc.pyexecutessofficewith macro invocation arguments, as well astimeoutorgtimeoututilities.scripts/office/validators/redlining.pyexecutesgit diffto compare document versions.
Recommendations
- AI detected serious security threats
Audit Metadata