xlsx
Warn
Audited by Gen Agent Trust Hub on Feb 23, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION] (MEDIUM): The script executes system binaries (soffice, timeout) using paths derived from user input. While using list-based subprocess calls, interaction with external office suites for data processing increases the attack surface.
- [DYNAMIC_EXECUTION] (MEDIUM): The script generates a LibreOffice Basic macro on-the-fly and saves it to the user's application configuration directory (e.g., ~/.config/libreoffice) before execution via a URI handler. Runtime code generation and modification of application configuration are risky patterns.
- [INDIRECT_PROMPT_INJECTION] (LOW): The skill processes untrusted Excel data which could contain malicious content targeting the parser or the LibreOffice environment. 1. Ingestion points: recalc.py command-line argument. 2. Boundary markers: Absent. 3. Capability inventory: File system write (Module1.xba) and subprocess execution. 4. Sanitization: None.
Audit Metadata