Habilidades libreoffice-writer Historial de auditorías
📄

Historial de auditorías

libreoffice-writer - 2 auditorías

Versión de auditoría 2

Más reciente Riesgo bajo

Mar 19, 2026, 04:04 PM

Static analysis flagged 175 patterns but evaluation confirms these are false positives. The skill legitimately uses subprocess to launch LibreOffice with hardcoded arguments, tempfile for secure temp directories, and importlib for module detection. All external command usage has no user input injection vectors. Risk is low due to filesystem and external command dependencies requiring LibreOffice installation.

14
Archivos escaneados
2,550
Líneas analizadas
7
hallazgos
claude
Auditado por
Problemas de riesgo bajo (3)
scripts/uno_bridge.py:140-155
External Process Execution
subprocess.Popen launches LibreOffice soffice binary. All arguments are hardcoded strings with no user input injection. This is legitimate automation of installed software.
scripts/uno_bridge.py:136
Temporary Directory Creation
Uses tempfile.mkdtemp() to create isolated profile directories for LibreOffice instances. Directories are cleaned up in finally blocks.
scripts/uno_bridge.py:69-71
Environment Variable Access
Reads LIBREOFFICE_PROGRAM_PATH environment variable to locate UNO module. Value is used only for path resolution, not executed.

Factores de riesgo

⚙️ Comandos externos (1)
scripts/uno_bridge.py:140-155
📁 Acceso al sistema de archivos (2)
scripts/uno_bridge.py:136 scripts/uno_bridge.py:189
🔑 Variables de entorno (1)
scripts/uno_bridge.py:69-71
⚡ Contiene scripts (2)
scripts/writer/metadata.py:6-9 scripts/writer/session.py:12-17

Versión de auditoría 1

Seguro

Mar 10, 2026, 07:18 AM

Static analysis flagged 87 potential issues, but manual review confirms all are false positives. The skill is legitimate LibreOffice Writer automation using UNO bridge. Subprocess calls are for finding/launching LibreOffice, not user-controlled command execution. CSS color codes were misidentified as cryptographic hashes. Dynamic imports are standard UNO library loading patterns.

14
Archivos escaneados
1,298
Líneas analizadas
1
hallazgos
claude
Auditado por
Problemas de riesgo medio (1)
scripts/uno_bridge.py:25scripts/uno_bridge.py:100
Subprocess Execution for LibreOffice Discovery
subprocess.run and subprocess.Popen are used in uno_bridge.py to find and launch LibreOffice. Arguments are hardcoded strings, not user input. No command injection risk exists.
← Volver a Skill