xlsx
Pass
Audited by Gen Agent Trust Hub on May 5, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The provided
recalc.pyscript executes thesoffice(LibreOffice) command and system timeout utilities (timeoutorgtimeout) to perform formula recalculation. These commands are executed safely using argument lists rather than shell strings. - [PROMPT_INJECTION]: The skill processes untrusted spreadsheet data (.xlsx, .csv, etc.), which presents a surface for indirect prompt injection attacks.
- Ingestion points: Data is ingested via
pd.read_excelandload_workbookas described inSKILL.md. - Boundary markers: None identified in the provided instructions.
- Capability inventory: Includes file system access, file writing, and local command execution via the
recalc.pyscript. - Sanitization: No explicit sanitization or validation of spreadsheet content is implemented.
- [SAFE]: The
recalc.pyscript performs necessary configuration by writing a LibreOffice macro to the user's application configuration directory (e.g.,~/.config/libreoffice/or~/Library/Application Support/LibreOffice/). This is a legitimate functional requirement for automated recalculation.
Audit Metadata