xlsx

Warn

Audited by Gen Agent Trust Hub on Mar 10, 2026

Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script recalc.py uses subprocess.run to execute soffice (LibreOffice) commands with headless flags. While intended for formula recalculation, it executes system-level binaries.
  • [DYNAMIC_EXECUTION]: The recalc.py script dynamically generates and writes a LibreOffice Basic macro (Module1.xba) to the user's application support directory (~/Library/Application Support/LibreOffice/... or ~/.config/libreoffice/...) at runtime.
  • [PRIVILEGE_ESCALATION]: The script modifies application configuration files by creating or overwriting macro modules in the LibreOffice profile directory, which could potentially be used to achieve persistence or execute arbitrary code within the LibreOffice context.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 10, 2026, 01:49 AM