📄

Audit History

libreoffice-writer - 2 audits

Audit version 2

Latest Low Risk

Mar 19, 2026, 04:04 PM

Static analysis flagged 175 patterns but evaluation confirms these are false positives. The skill legitimately uses subprocess to launch LibreOffice with hardcoded arguments, tempfile for secure temp directories, and importlib for module detection. All external command usage has no user input injection vectors. Risk is low due to filesystem and external command dependencies requiring LibreOffice installation.

Files scanned

2,550

Lines analyzed

findings

claude

Audited by

Low Risk Issues (3)

scripts/uno_bridge.py:140-155

External Process Execution

subprocess.Popen launches LibreOffice soffice binary. All arguments are hardcoded strings with no user input injection. This is legitimate automation of installed software.

scripts/uno_bridge.py:136

Temporary Directory Creation

Uses tempfile.mkdtemp() to create isolated profile directories for LibreOffice instances. Directories are cleaned up in finally blocks.

scripts/uno_bridge.py:69-71

Environment Variable Access

Reads LIBREOFFICE_PROGRAM_PATH environment variable to locate UNO module. Value is used only for path resolution, not executed.

Risk Factors

⚙️ External commands (1)

scripts/uno_bridge.py:140-155

📁 Filesystem access (2)

scripts/uno_bridge.py:136 scripts/uno_bridge.py:189

🔑 Env variables (1)

scripts/uno_bridge.py:69-71

⚡ Contains scripts (2)

scripts/writer/metadata.py:6-9 scripts/writer/session.py:12-17

Audit version 1

Safe

Mar 10, 2026, 07:18 AM

Static analysis flagged 87 potential issues, but manual review confirms all are false positives. The skill is legitimate LibreOffice Writer automation using UNO bridge. Subprocess calls are for finding/launching LibreOffice, not user-controlled command execution. CSS color codes were misidentified as cryptographic hashes. Dynamic imports are standard UNO library loading patterns.

Files scanned

1,298

Lines analyzed

findings

claude

Audited by

Medium Risk Issues (1)

scripts/uno_bridge.py:25 scripts/uno_bridge.py:100

Subprocess Execution for LibreOffice Discovery

subprocess.run and subprocess.Popen are used in uno_bridge.py to find and launch LibreOffice. Arguments are hardcoded strings, not user input. No command injection risk exists.

← Back to Skill