xlsx

Pass

Audited by Gen Agent Trust Hub on Feb 26, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The recalc.py script executes the soffice (LibreOffice) binary via subprocess.run to perform headless formula recalculation. It also utilizes system timeout or gtimeout commands to manage process execution limits.
  • [DYNAMIC_EXECUTION]: To enable recalculation, recalc.py writes a StarBasic macro (Module1.xba) to the user's local LibreOffice configuration directory. This macro is a hardcoded template used to trigger the calculateAll and store methods within the office suite.
  • [INDIRECT_PROMPT_INJECTION]: As the skill is designed to read and process external .xlsx and .csv files using pandas and openpyxl, it possesses an inherent surface for indirect prompt injection. However, the skill treats spreadsheet content as data for calculation and formatting rather than as a source of instructions for the agent's core logic.
  • Ingestion points: Reading Excel files via pd.read_excel() and load_workbook() in SKILL.md code examples.
  • Boundary markers: Not explicitly defined in the provided Python snippets.
  • Capability inventory: File system writes (wb.save), and command execution via recalc.py and scripts/generate_schematic.py.
  • Sanitization: Standard library parsing is used, but no specific NL sanitization is implemented for cell content.
Audit Metadata
Risk Level
SAFE
Analyzed
Feb 26, 2026, 05:50 AM