xlsx
Warn
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The script scripts/office/soffice.py dynamically generates C code, compiles it using gcc, and injects the resulting shared library into the soffice process via LD_PRELOAD. This bypasses system socket restrictions but involves runtime binary generation and loading.
- [REMOTE_CODE_EXECUTION]: The recalculation logic in scripts/recalc.py programmatically installs a StarBasic macro (Module1.xba) into the user's global LibreOffice configuration directory to enable automated workbook updates, which is a persistent configuration change.
- [COMMAND_EXECUTION]: Multiple scripts, including recalc.py and soffice.py, use subprocess.run to execute system utilities like soffice, gcc, and git for core functionality.
- [PROMPT_INJECTION]: Indirect injection surface documented: 1. Ingestion: pd.read_excel in SKILL.md and load_workbook in recalc.py. 2. Boundaries: Absent. 3. Capabilities: subprocess.run in recalc.py and soffice.py. 4. Sanitization: defusedxml is used for XML parsing, but the skill lacks markers to ignore natural language instructions within spreadsheet data.
- [COMMAND_EXECUTION]: scripts/office/unpack.py uses zipfile.extractall on user-provided Office files without path validation, creating a potential surface for path traversal (Zip Slip) attacks.
Audit Metadata