The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several local command-line tools to process data, including qsv, DuckDB, and LibreOffice (via soffice). These are executed using Python's subprocess.run with argument lists rather than shell strings, which is a secure implementation that prevents shell injection.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to handle potentially untrusted spreadsheet data. It implements specific security measures to mitigate risks, such as Invariant 6 in SKILL.md which requires escaping cells starting with formula prefixes (=, +, @). The profile.py script also includes a dedicated scanner for these prefixes, enabling the agent to detect and handle malicious payloads in processed files.
[DYNAMIC_EXECUTION]: The recalc.py script dynamically generates a temporary LibreOffice macro (StarBasic) to perform headless formula recalculation in Excel files. This is a specialized technical workaround for lack of a native recalculation engine in Python libraries and is restricted to a temporary, isolated user profile, minimizing risk.
[EXTERNAL_DOWNLOADS]: The skill references the use of daff via bunx for data diffing. bunx is a well-known tool for executing npm packages, and daff is an established open-source tool for tabular data comparison. These are standard developer tools and do not pose a threat in this context.

spreadsheets