xlsx
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
recalc.pyscript invokes the LibreOffice binary to recalculate formulas within workbooks. This is implemented securely usingsubprocess.runwith an argument list, which avoids the risks associated with shell interpretation. - [INDIRECT_PROMPT_INJECTION]: The skill documentation includes safety protocols (ASI01) for the agent, treating all content within processed Excel workbooks as untrusted to prevent malicious data from influencing the agent's behavior.
- [DATA_EXPOSURE]: The skill incorporates specific privacy guidelines (ASI03) requiring the agent to protect PII and financial data by restricting data extraction and preventing row-level data from entering logs.
- [REMOTE_CODE_EXECUTION]: A security-first approach is taken regarding external links (ASI04, ASI05); the verification script automatically scans for and warns about external dependencies or DDE references in OOXML packages before processing.
Audit Metadata