minimax-xlsx

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run within scripts/libreoffice_recalc.py to interface with the LibreOffice soffice binary for headless formula recalculation. It also utilizes subprocess calls in scripts/xlsx_insert_row.py to trigger internal row-shifting logic. These implementations use argument lists (not shell=True), which is a secure practice for calling local tools required for the task.
  • [SAFE]: The skill implements a sophisticated 'unpack-edit-pack' workflow to avoid data loss associated with common Python spreadsheet libraries. It features extensive deterministic validation via formula_check.py (scanning XML for error codes and broken references) and style_audit.py (checking compliance with financial formatting rules).
  • [PROMPT_INJECTION]: The skill possesses a data ingestion surface through its ability to read user-provided Excel and CSV files. While this creates a potential for indirect prompt injection, the skill's instructions focus on structured data analysis and XML-based template filling, which mitigates the risk of the agent interpreting data as instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 07:46 AM
Security Audit — agent-trust-hub — minimax-xlsx