Fähigkeiten libreoffice-writer Audit-Verlauf
📄

Audit-Verlauf

libreoffice-writer - 2 Audits

Audit-Version 2

Neueste Niedriges Risiko

Mar 19, 2026, 04:04 PM

Static analysis flagged 175 patterns but evaluation confirms these are false positives. The skill legitimately uses subprocess to launch LibreOffice with hardcoded arguments, tempfile for secure temp directories, and importlib for module detection. All external command usage has no user input injection vectors. Risk is low due to filesystem and external command dependencies requiring LibreOffice installation.

14
Gescannte Dateien
2,550
Analysierte Zeilen
7
befunde
claude
Auditiert von
Probleme mit niedrigem Risiko (3)
scripts/uno_bridge.py:140-155
External Process Execution
subprocess.Popen launches LibreOffice soffice binary. All arguments are hardcoded strings with no user input injection. This is legitimate automation of installed software.
scripts/uno_bridge.py:136
Temporary Directory Creation
Uses tempfile.mkdtemp() to create isolated profile directories for LibreOffice instances. Directories are cleaned up in finally blocks.
scripts/uno_bridge.py:69-71
Environment Variable Access
Reads LIBREOFFICE_PROGRAM_PATH environment variable to locate UNO module. Value is used only for path resolution, not executed.

Risikofaktoren

⚙️ Externe Befehle (1)
scripts/uno_bridge.py:140-155
📁 Dateisystemzugriff (2)
scripts/uno_bridge.py:136 scripts/uno_bridge.py:189
🔑 Umgebungsvariablen (1)
scripts/uno_bridge.py:69-71
⚡ Enthält Skripte (2)
scripts/writer/metadata.py:6-9 scripts/writer/session.py:12-17

Audit-Version 1

Sicher

Mar 10, 2026, 07:18 AM

Static analysis flagged 87 potential issues, but manual review confirms all are false positives. The skill is legitimate LibreOffice Writer automation using UNO bridge. Subprocess calls are for finding/launching LibreOffice, not user-controlled command execution. CSS color codes were misidentified as cryptographic hashes. Dynamic imports are standard UNO library loading patterns.

14
Gescannte Dateien
1,298
Analysierte Zeilen
1
befunde
claude
Auditiert von
Probleme mit mittlerem Risiko (1)
scripts/uno_bridge.py:25scripts/uno_bridge.py:100
Subprocess Execution for LibreOffice Discovery
subprocess.run and subprocess.Popen are used in uno_bridge.py to find and launch LibreOffice. Arguments are hardcoded strings, not user input. No command injection risk exists.
← Zurück zum Skill