spreadsheets

Pass

Audited by Gen Agent Trust Hub on Jun 20, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The bundled scripts (peek.py, profile.py, recalc.py) use subprocess.run to execute local command-line tools. These tools (qsv, duckdb, and soffice) are used for legitimate spreadsheet processing tasks such as structural validation, statistical profiling, and formula recalculation.
  • [DATA_EXFILTRATION]: The skill contains explicit safety instructions (Hard Rule 7) directing the agent to treat data as private and never send it to external APIs or web services. Analysis of the scripts confirms they only perform local operations.
  • [DYNAMIC_EXECUTION]: The recalc.py script dynamically generates a temporary LibreOffice macro (StarBasic) to force the recalculation of Excel formulas in headless mode. The macro code is static and embedded within the script, used solely for the stated purpose of workbook auditing.
  • [PROMPT_INJECTION]: No malicious prompt injection patterns were detected. The instructions are focused on technical data handling, formatting conventions, and safety guards (e.g., escaping formula injection cells).
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 20, 2026, 02:12 PM
Security Audit — agent-trust-hub — spreadsheets