xlsx-official
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The recalc.py utility utilizes subprocess.run() to invoke soffice (LibreOffice) and timeout/gtimeout commands. These operations are required to perform headless formula recalculation in Excel files, matching the skill's intended purpose.
- [COMMAND_EXECUTION]: The recalc.py script programmatically generates a local StarBasic macro file (Module1.xba) within the user's LibreOffice configuration directory. This is a functional requirement to enable calculateAll() and store() operations via the command line.
- [PROMPT_INJECTION]: The skill processes spreadsheet data which acts as an ingestion point for untrusted content. While this creates an attack surface for indirect prompt injection from cell data, no malicious instructions or exploits were identified in the skill's logic or templates.
Audit Metadata