calc
Pass
Audited by Gen Agent Trust Hub on Nov 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
soffice(LibreOffice) command-line tool for spreadsheet creation and format conversion. - Evidence: Commands such as
soffice --headless --convert-to xlsx spreadsheet.odsandsoffice --calc template.odsare used for automation. - Evidence: The skill instructs the agent to bind the UNO listener specifically to the loopback interface (
127.0.0.1) to prevent external exposure. - [EXTERNAL_DOWNLOADS]: The skill mentions the installation of standard, well-known Python libraries for spreadsheet manipulation.
- Evidence:
pip install ezodf,pip install odfpy, andpip install pandasare listed as requirements for specific workflows. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface by processing external spreadsheet formats (ODS, XLSX, CSV, DBF) which could contain malicious macros or formulas.
- Evidence: The skill processes user-provided or external files through
sofficeand Python libraries. - Boundary Markers: The skill includes a dedicated 'Automation and document limits' section that explicitly warns against opening untrusted documents without disabling macros and external updates.
- Capability Inventory: The skill has file-write capabilities and command execution through
sofficeand Python scripts. - Sanitization: It recommends using approved inputs and isolating conversions in fresh private directories.
Audit Metadata