xlsx

Pass

Audited by Gen Agent Trust Hub on May 9, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The recalc.py script executes system commands (soffice, timeout, gtimeout) using the subprocess.run module. These calls are used to interact with the local LibreOffice installation to perform headless formula recalculation and error checking on spreadsheet files.
  • [DYNAMIC_EXECUTION]: The script recalc.py programmatically generates a LibreOffice Basic macro file (Module1.xba) in the user's local configuration directory. This macro is required for the automated 'CalculateAll' and 'Store' operations triggered via the command line.
  • [INDIRECT_PROMPT_INJECTION]: The skill operates on user-provided Excel and CSV files, which serves as an ingestion point for untrusted data that could potentially exploit vulnerabilities in spreadsheet parsing libraries or the recalculation engine.
  • Ingestion points: recalc.py, SKILL.md, and references/common-use-cases.md (via load_workbook, read_excel, and soffice).
  • Boundary markers: None present in the logic to separate untrusted file content from processing instructions.
  • Capability inventory: The skill has the ability to execute system commands (subprocess.run), write to the filesystem, and read arbitrary Excel files.
  • Sanitization: The skill relies on standard library implementations (openpyxl, pandas) for file parsing and utilizes absolute path resolution for file handling.
Audit Metadata
Risk Level
SAFE
Analyzed
May 9, 2026, 09:13 PM
Security Audit — agent-trust-hub — xlsx