xlsx
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
recalc.pyscript executes system commands includingsoffice(LibreOffice),timeout, andgtimeoutto automate formula recalculation. These commands are executed using argument lists rather than shell strings, which mitigates command injection risks. - [DYNAMIC_EXECUTION]: The
recalc.pyscript dynamically generates a StarBasic macro file (Module1.xba) and writes it to the user's LibreOffice configuration directory. This macro is required for thesofficeheadless recalculation process and follows a static template defined within the script. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external spreadsheet data which could theoretically contain malicious instructions.
- Ingestion points: Spreadsheet files read using
pandas.read_excelandopenpyxl.load_workbookinSKILL.mdandrecalc.py. - Boundary markers: The instructions do not define specific delimiters for untrusted data, though they emphasize matching existing template formats.
- Capability inventory: The skill can write files to the filesystem and execute shell commands through the
recalc.pyutility. - Sanitization: No specific sanitization or filtering of cell contents is mentioned before processing.
Audit Metadata