Навыки libreoffice-writer История аудитов
📄

История аудитов

libreoffice-writer - 2 аудиты

Версия аудита 2

Последняя Низкий риск

Mar 19, 2026, 04:04 PM

Static analysis flagged 175 patterns but evaluation confirms these are false positives. The skill legitimately uses subprocess to launch LibreOffice with hardcoded arguments, tempfile for secure temp directories, and importlib for module detection. All external command usage has no user input injection vectors. Risk is low due to filesystem and external command dependencies requiring LibreOffice installation.

14
Просканировано файлов
2,550
Проанализировано строк
7
находки
claude
Проверено
Проблемы низкого риска (3)
scripts/uno_bridge.py:140-155
External Process Execution
subprocess.Popen launches LibreOffice soffice binary. All arguments are hardcoded strings with no user input injection. This is legitimate automation of installed software.
scripts/uno_bridge.py:136
Temporary Directory Creation
Uses tempfile.mkdtemp() to create isolated profile directories for LibreOffice instances. Directories are cleaned up in finally blocks.
scripts/uno_bridge.py:69-71
Environment Variable Access
Reads LIBREOFFICE_PROGRAM_PATH environment variable to locate UNO module. Value is used only for path resolution, not executed.

Факторы риска

⚙️ Внешние команды (1)
scripts/uno_bridge.py:140-155
📁 Доступ к файловой системе (2)
scripts/uno_bridge.py:136 scripts/uno_bridge.py:189
🔑 Переменные окружения (1)
scripts/uno_bridge.py:69-71
⚡ Содержит скрипты (2)
scripts/writer/metadata.py:6-9 scripts/writer/session.py:12-17

Версия аудита 1

Безопасно

Mar 10, 2026, 07:18 AM

Static analysis flagged 87 potential issues, but manual review confirms all are false positives. The skill is legitimate LibreOffice Writer automation using UNO bridge. Subprocess calls are for finding/launching LibreOffice, not user-controlled command execution. CSS color codes were misidentified as cryptographic hashes. Dynamic imports are standard UNO library loading patterns.

14
Просканировано файлов
1,298
Проанализировано строк
1
находки
claude
Проверено
Проблемы среднего риска (1)
scripts/uno_bridge.py:25scripts/uno_bridge.py:100
Subprocess Execution for LibreOffice Discovery
subprocess.run and subprocess.Popen are used in uno_bridge.py to find and launch LibreOffice. Arguments are hardcoded strings, not user input. No command injection risk exists.
← Назад к навыку