skills/rohitg00/buildwithclaude/xlsx/Gen Agent Trust Hub

xlsx

Pass

Audited by Gen Agent Trust Hub on Jul 18, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The recalc.py script executes system commands including soffice (LibreOffice), timeout, and gtimeout to automate formula recalculation. These commands are executed using argument lists rather than shell strings, which mitigates command injection risks.
  • [DYNAMIC_EXECUTION]: The recalc.py script dynamically generates a StarBasic macro file (Module1.xba) and writes it to the user's LibreOffice configuration directory. This macro is required for the soffice headless recalculation process and follows a static template defined within the script.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external spreadsheet data which could theoretically contain malicious instructions.
  • Ingestion points: Spreadsheet files read using pandas.read_excel and openpyxl.load_workbook in SKILL.md and recalc.py.
  • Boundary markers: The instructions do not define specific delimiters for untrusted data, though they emphasize matching existing template formats.
  • Capability inventory: The skill can write files to the filesystem and execute shell commands through the recalc.py utility.
  • Sanitization: No specific sanitization or filtering of cell contents is mentioned before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 18, 2026, 04:25 PM
Security Audit — agent-trust-hub — xlsx