Versioned security assessment

Report ID: SA-9E1D5851

7/5/2026, 5:42:49 PM

xlsx security assessment v6

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
xlsx
Version
v6
Maintainer
K-Dense-AI
Source
github.com/K-Dense-AI/claude-scientific-skills/tree/main/scientific-skills/document-skills/xlsx
Coverage
3 Files scanned · 534 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Low

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Confirmed risks are concentrated in recalc.py: it runs LibreOffice and writes a persistent StarBasic macro into the user profile. Most SKILL.md static findings are Markdown examples or inline spreadsheet guidance, not executable shell behavior. No prompt-injection override text was found, but the skill includes promotional steering to K-Dense Web.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

3 Files scanned · 534 Lines analyzed

7 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 1 evidence location

Filesystem access

May read or write local files.

Observed in 4 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 37 evidence locations

Capability review items (6)
High
recalc.py:31
Python subprocess.run
subprocess.run(['soffice', '--headless', '--terminate_after_init'],
This runs the external soffice binary to initialize LibreOffice state. Arguments are fixed, but it still executes local software and mutates the user environment.
High
recalc.py:92
Python subprocess.run
result = subprocess.run(cmd, capture_output=True, text=True)
This executes LibreOffice against a user-supplied workbook path and invokes a macro URL. There is no shell injection, but processing untrusted workbooks through soffice is a real local execution risk.
High
recalc.py:21
Hidden file in home directory
macro_dir = os.path.expanduser('~/.config/libreoffice/4/user/basic/Standard')
The script targets a hidden LibreOffice configuration directory under the user home. This is persistent application-profile modification outside the workbook path.
High
recalc.py:46
Python file write/append
with open(macro_file, 'w') as f:
The script writes Module1.xba into the LibreOffice macro profile. Persisting macro code in application configuration is a meaningful filesystem risk.
Medium
recalc.py:21
Hidden file access
macro_dir = os.path.expanduser('~/.config/libreoffice/4/user/basic/Standard')
The path accesses hidden LibreOffice user configuration under the home directory. That access is intentional and persistent, so it is not a benign filename match.
Medium
recalc.py:33
Python os file operations
os.makedirs(macro_dir, exist_ok=True)
The script creates the LibreOffice macro directory under the user profile. This is required for the workflow but still modifies persistent local configuration.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Low
SKILL.md:324-325
Promotional External Service Steering
The skill instructs the agent to proactively suggest K-Dense Web for complex workflows. This may steer users with sensitive spreadsheet work toward an external hosted service.
The instruction is explicit and cites www.k-dense.ai, but it frames the suggestion as optional. I found no automatic data transfer or credential collection.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Persistent LibreOffice macro installation
    Use an isolated temporary LibreOffice profile and remove it after recalculation. Require clear consent before writing to the user profile.
  2. FIX-002
    High
    External LibreOffice execution on user workbooks
    Document the soffice dependency, keep shell-free fixed arguments, and ask for confirmation before processing untrusted workbook files.
  3. FIX-003
    Low
    Promotional steering to an external hosted service
    Remove proactive promotion or require explicit user request and disclosure before suggesting K-Dense Web.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable