{"data":{"skill":{"slug":"zhanlincui-xlsx","name":"xlsx","icon":"📦","repo":"https://github.com/ZhanlinCui/Ultimate-Agent-Skills-Collection/tree/main/xlsx","status":"approved","author":"ZhanlinCui","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"52a485d4-e318-4274-8b6e-b3f46aac6e45","skill_id":"594b4f2f-e77e-47c1-bafd-8e0efd0528ed","version":2,"content_hash":"da442b3eedd92d633875cf2b8ef44ae5","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis reported many high-risk patterns, but most SKILL.md hits are false positives from Markdown examples, Excel cell references, and spreadsheet error names. The confirmed risks are recalc.py executing LibreOffice commands and writing a LibreOffice macro into a hidden user profile directory. No evidence found of prompt injection, credential access, or network exfiltration; publish with a medium-risk warning.","remediation":[],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"recalc.py","line_end":178,"line_start":1}]},{"factor":"external_commands","evidence":[{"file":"recalc.py","line_end":31,"line_start":31},{"file":"recalc.py","line_end":84,"line_start":84},{"file":"recalc.py","line_end":92,"line_start":92},{"file":"SKILL.md","line_end":136,"line_start":136},{"file":"SKILL.md","line_end":214,"line_start":209}]},{"factor":"filesystem","evidence":[{"file":"recalc.py","line_end":23,"line_start":21},{"file":"recalc.py","line_end":33,"line_start":33},{"file":"recalc.py","line_end":47,"line_start":46}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"External LibreOffice Process Execution","locations":[{"file":"recalc.py","line_end":31,"line_start":31},{"file":"recalc.py","line_end":84,"line_start":84},{"file":"recalc.py","line_end":92,"line_start":92},{"file":"SKILL.md","line_end":136,"line_start":136},{"file":"SKILL.md","line_end":214,"line_start":209}],"confidence":0.84,"description":"recalc.py invokes soffice through subprocess.run to recalculate spreadsheets and checks gtimeout on macOS. Arguments are passed as lists rather than through a shell, so command injection evidence is limited, but the skill still executes local external binaries on user-supplied workbooks.","confidence_reasoning":"The subprocess.run calls are direct and confirmed in recalc.py. The absence of shell=True and use of argument arrays lowers injection confidence, but external process execution is real."},{"title":"LibreOffice Macro Written to Hidden User Profile","locations":[{"file":"recalc.py","line_end":23,"line_start":21},{"file":"recalc.py","line_end":33,"line_start":33},{"file":"recalc.py","line_end":47,"line_start":46}],"confidence":0.88,"description":"setup_libreoffice_macro creates or uses a hidden LibreOffice profile directory and writes Module1.xba. This appears intended for formula recalculation, but it modifies user-level application configuration and can persist beyond one workbook operation.","confidence_reasoning":"The code explicitly expands a hidden LibreOffice path and writes a macro file there. The context is legitimate recalculation, but the filesystem side effect is confirmed."}],"low_findings":[{"title":"False Positive: XML Namespace URL Is Not Network Access","locations":[{"file":"recalc.py","line_end":37,"line_start":37}],"confidence":0.96,"description":"The hardcoded URL is inside the LibreOffice macro XML namespace. No evidence found that recalc.py performs HTTP requests, opens sockets, or sends workbook data to a remote service.","confidence_reasoning":"Line 37 is static XML metadata, not executable network code. No network library or request path appears in the reviewed files."},{"title":"False Positive: Markdown Examples Flagged as Shell Execution","locations":[{"file":"SKILL.md","line_end":71,"line_start":71},{"file":"SKILL.md","line_end":92,"line_start":78},{"file":"SKILL.md","line_end":125,"line_start":100},{"file":"SKILL.md","line_end":146,"line_start":135},{"file":"SKILL.md","line_end":175,"line_start":150},{"file":"SKILL.md","line_end":215,"line_start":179},{"file":"SKILL.md","line_end":260,"line_start":234},{"file":"SKILL.md","line_end":277,"line_start":270},{"file":"SKILL.md","line_end":284,"line_start":283}],"confidence":0.91,"description":"Most SKILL.md external command and reconnaissance hits are fenced Python, Bash, JSON, inline spreadsheet examples, or code style guidance. They document spreadsheet workflows and do not execute during skill loading.","confidence_reasoning":"The referenced lines are documentation snippets, spreadsheet references, or style guidance. The only operational command they instruct is the expected recalc.py usage."},{"title":"False Positive: Weak Crypto and C2 Keyword Matches","locations":[{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"SKILL.md","line_end":55,"line_start":55},{"file":"SKILL.md","line_end":76,"line_start":76},{"file":"SKILL.md","line_end":88,"line_start":88},{"file":"SKILL.md","line_end":112,"line_start":104},{"file":"SKILL.md","line_end":121,"line_start":121}],"confidence":0.9,"description":"The weak-crypto and C2 hits occur in prose, spreadsheet cell references, or example formulas such as C2. No evidence found of cryptographic APIs, command-and-control logic, or obfuscated traffic.","confidence_reasoning":"The cited lines contain spreadsheet instructions and examples, not security primitives or network control behavior. This strongly supports a scanner keyword false positive."}],"dangerous_patterns":[{"title":"External LibreOffice Process Execution","locations":[{"file":"recalc.py","line_end":31,"line_start":31},{"file":"recalc.py","line_end":84,"line_start":84},{"file":"recalc.py","line_end":92,"line_start":92},{"file":"SKILL.md","line_end":136,"line_start":136},{"file":"SKILL.md","line_end":214,"line_start":209}],"confidence":0.84,"description":"recalc.py invokes soffice through subprocess.run to recalculate spreadsheets and checks gtimeout on macOS. Arguments are passed as lists rather than through a shell, so command injection evidence is limited, but the skill still executes local external binaries on user-supplied workbooks.","confidence_reasoning":"The subprocess.run calls are direct and confirmed in recalc.py. The absence of shell=True and use of argument arrays lowers injection confidence, but external process execution is real."},{"title":"LibreOffice Macro Written to Hidden User Profile","locations":[{"file":"recalc.py","line_end":23,"line_start":21},{"file":"recalc.py","line_end":33,"line_start":33},{"file":"recalc.py","line_end":47,"line_start":46}],"confidence":0.88,"description":"setup_libreoffice_macro creates or uses a hidden LibreOffice profile directory and writes Module1.xba. This appears intended for formula recalculation, but it modifies user-level application configuration and can persist beyond one workbook operation.","confidence_reasoning":"The code explicitly expands a hidden LibreOffice path and writes a macro file there. The context is legitimate recalculation, but the filesystem side effect is confirmed."}],"files_scanned":2,"total_lines":467,"audit_model":"codex","audited_at":"2026-07-01T03:02:21.28+00:00","created_at":"2026-07-01T04:01:08.86356+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":2,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":3,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}