spreadsheets
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The scripts
peek.py,profile.py, andrecalc.pyutilizesubprocess.runto invoke external spreadsheet utilities includingqsv,duckdb, andsoffice(LibreOffice). These executions are performed using list-based arguments without shell invocation, ensuring that file paths and parameters are handled safely within the local environment. - [DYNAMIC_EXECUTION]: The
recalc.pyscript dynamically generates a temporary LibreOffice macro to automate workbook recalculation. This process uses a static, hardcoded StarBasic template and executes within an isolated, temporary application profile to ensure the integrity of the recalculation process. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data (CSV/Excel files). It proactively addresses indirect prompt injection risks by instructing the agent to escape spreadsheet formula-prefix cells (
=,+, and@) and provides built-in redaction flags (--redact-samples) in the profiling tools to prevent the exposure of sensitive cell data.
Audit Metadata