xlsx
Pass
Audited by Gen Agent Trust Hub on Feb 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- COMMAND_EXECUTION (MEDIUM): The utility script
recalc.pydynamically generates a LibreOffice Basic macro and writes it to the user configuration directory before executing it viasubprocess.run. This qualifies as dynamic script generation and execution for formula verification. - EXTERNAL_DOWNLOADS (LOW): The skill metadata references the
anthropics/skillsGitHub repository, which is a recognized trusted source. - PROMPT_INJECTION (LOW): This skill is vulnerable to indirect prompt injection through ingested spreadsheet data. 1. Ingestion points:
recalc.pyandexamples.md(via pandas and openpyxl). 2. Boundary markers: Absent. 3. Capability inventory: Subprocess execution and filesystem writes. 4. Sanitization: No validation or escaping of cell content is implemented.
Audit Metadata