minimax-xlsx
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runwithinscripts/libreoffice_recalc.pyto interface with the LibreOfficesofficebinary for headless formula recalculation. It also utilizes subprocess calls inscripts/xlsx_insert_row.pyto trigger internal row-shifting logic. These implementations use argument lists (not shell=True), which is a secure practice for calling local tools required for the task. - [SAFE]: The skill implements a sophisticated 'unpack-edit-pack' workflow to avoid data loss associated with common Python spreadsheet libraries. It features extensive deterministic validation via
formula_check.py(scanning XML for error codes and broken references) andstyle_audit.py(checking compliance with financial formatting rules). - [PROMPT_INJECTION]: The skill possesses a data ingestion surface through its ability to read user-provided Excel and CSV files. While this creates a potential for indirect prompt injection, the skill's instructions focus on structured data analysis and XML-based template filling, which mitigates the risk of the agent interpreting data as instructions.
Audit Metadata