xlsx
Warn
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- Persistence Mechanisms (MEDIUM): The script writes a StarBasic macro to the user's hidden configuration directory (
~/.config/libreoffice/4/user/basic/Standard/Module1.xbaor the macOS equivalent). This macro persists after the script finishes and will be loaded by LibreOffice in future sessions. - Dynamic Execution (MEDIUM): The script dynamically generates executable code (a LibreOffice macro) from a hardcoded string and writes it to the filesystem before triggering its execution via the
sofficecommand-line interface. - Command Execution (LOW): The script executes external system binaries including
soffice,timeout, andgtimeoutusingsubprocess.run. While it uses list-based arguments to prevent shell injection, it relies on the integrity of the local environment's binaries.
Audit Metadata