usable-xlsm

Warn

Audited by Socket on Sep 13, 2026

1 alert found:

Security
SecurityMEDIUM
src/usable_xlsm/_worker.py

This module is a Windows Excel COM automation worker that can open an attacker-controlled workbook, inject/overwrite VBA module source code, and execute attacker-supplied macros (and optionally persist changes). It does not contain obvious network exfiltration or direct malware payload code in Python, but it provides a high-risk execution primitive that could be used for sabotage or data theft via VBA. Treat as security-sensitive and ensure strict input validation and controlled usage/sandboxing.

Confidence: 72%Severity: 74%
Audit Metadata
Analyzed At
Sep 13, 2026, 08:13 AM
Package URL
pkg:socket/skills-sh/nogikun%2Fskills%2Fusable-xlsm%2F@ca7d985659de904ca1bf36b5e647ca858fc01989229fff56aba7d7bd95f035ca