xlsx
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
recalc.pyscript executes system commands (soffice,timeout,gtimeout) using thesubprocess.runmodule. These calls are used to interact with the local LibreOffice installation to perform headless formula recalculation and error checking on spreadsheet files. - [DYNAMIC_EXECUTION]: The script
recalc.pyprogrammatically generates a LibreOffice Basic macro file (Module1.xba) in the user's local configuration directory. This macro is required for the automated 'CalculateAll' and 'Store' operations triggered via the command line. - [INDIRECT_PROMPT_INJECTION]: The skill operates on user-provided Excel and CSV files, which serves as an ingestion point for untrusted data that could potentially exploit vulnerabilities in spreadsheet parsing libraries or the recalculation engine.
- Ingestion points:
recalc.py,SKILL.md, andreferences/common-use-cases.md(viaload_workbook,read_excel, andsoffice). - Boundary markers: None present in the logic to separate untrusted file content from processing instructions.
- Capability inventory: The skill has the ability to execute system commands (
subprocess.run), write to the filesystem, and read arbitrary Excel files. - Sanitization: The skill relies on standard library implementations (
openpyxl,pandas) for file parsing and utilizes absolute path resolution for file handling.
Audit Metadata