skills/flora131/atomic/docx/Gen Agent Trust Hub

docx

Warn

Audited by Gen Agent Trust Hub on Apr 30, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes multiple system commands to handle document conversion and comparison.
  • It invokes soffice (LibreOffice) for headless document processing and macro execution in scripts/office/soffice.py and scripts/accept_changes.py.
  • It uses git diff for generating detailed document comparisons in scripts/office/validators/redlining.py.
  • Instructions in SKILL.md suggest the use of pandoc and pdftoppm for content extraction and image conversion.
  • [DYNAMIC_EXECUTION]: The skill performs advanced runtime code manipulation to ensure compatibility in specialized environments.
  • Runtime Compilation and Injection: In scripts/office/soffice.py, the skill writes a C source string to a temporary file, compiles it using gcc, and then uses the resulting shared object with LD_PRELOAD to shim socket-related system calls for the soffice process.
  • Macro Setup: In scripts/accept_changes.py, the skill dynamically writes a LibreOffice StarBasic macro (AcceptAllTrackedChanges) to the user profile and executes it to process document revisions.
  • [SAFE]: The skill demonstrates good security practices in data handling.
  • It uses the defusedxml library across several scripts (scripts/office/unpack.py, scripts/comment.py, scripts/office/validators/base.py) to mitigate XML External Entity (XXE) vulnerabilities during document parsing.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 30, 2026, 10:01 PM