xlsx

Warn

Audited by Gen Agent Trust Hub on May 18, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The script scripts/office/soffice.py performs dynamic code generation and runtime compilation. It writes a C source string to a temporary file (lo_socket_shim.c), compiles it into a shared library using gcc, and then injects this library into the LibreOffice process using the LD_PRELOAD environment variable to bypass environment-specific socket restrictions.
  • [COMMAND_EXECUTION]: The skill extensively uses subprocess.run to interact with the host system. This includes executing soffice for spreadsheet recalculation, invoking gcc for library compilation, and using git for document diffing. These operations occur in scripts/recalc.py, scripts/office/soffice.py, and scripts/office/validators/redlining.py.
  • [SAFE]: The skill utilizes the defusedxml library when parsing XML components of Office documents (scripts/office/validators/base.py). This is a security best practice that protects the agent from XML External Entity (XXE) vulnerabilities when processing user-supplied files.
Audit Metadata
Risk Level
MEDIUM
Analyzed
May 18, 2026, 05:05 AM
Security Audit — agent-trust-hub — xlsx