xlsx
Warn
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
recalc.pyusessubprocess.runto executesoffice(LibreOffice) commands with headless flags. While intended for formula recalculation, it executes system-level binaries. - [DYNAMIC_EXECUTION]: The
recalc.pyscript dynamically generates and writes a LibreOffice Basic macro (Module1.xba) to the user's application support directory (~/Library/Application Support/LibreOffice/...or~/.config/libreoffice/...) at runtime. - [PRIVILEGE_ESCALATION]: The script modifies application configuration files by creating or overwriting macro modules in the LibreOffice profile directory, which could potentially be used to achieve persistence or execute arbitrary code within the LibreOffice context.
Audit Metadata