Versioned security assessment

Report ID: SA-DA442B3E

7/1/2026, 3:02:21 AM

xlsx security assessment v2

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
xlsx
Version
v2
Maintainer
ZhanlinCui
Source
github.com/ZhanlinCui/Ultimate-Agent-Skills-Collection/tree/main/xlsx
Coverage
2 Files scanned · 467 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

2 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis reported many high-risk patterns, but most SKILL.md hits are false positives from Markdown examples, Excel cell references, and spreadsheet error names. The confirmed risks are recalc.py executing LibreOffice commands and writing a LibreOffice macro into a hidden user profile directory. No evidence found of prompt injection, credential access, or network exfiltration; publish with a medium-risk warning.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

2 Files scanned · 467 Lines analyzed

2 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 1 evidence location

Network access

May connect to external services.

Not recorded by this audit

Filesystem access

May read or write local files.

Observed in 3 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 5 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Medium
recalc.py:31recalc.py:84recalc.py:92SKILL.md:136SKILL.md:209-214
External LibreOffice Process Execution
recalc.py invokes soffice through subprocess.run to recalculate spreadsheets and checks gtimeout on macOS. Arguments are passed as lists rather than through a shell, so command injection evidence is limited, but the skill still executes local external binaries on user-supplied workbooks.
The subprocess.run calls are direct and confirmed in recalc.py. The absence of shell=True and use of argument arrays lowers injection confidence, but external process execution is real.
RISK-002 Medium
recalc.py:21-23recalc.py:33recalc.py:46-47
LibreOffice Macro Written to Hidden User Profile
setup_libreoffice_macro creates or uses a hidden LibreOffice profile directory and writes Module1.xba. This appears intended for formula recalculation, but it modifies user-level application configuration and can persist beyond one workbook operation.
The code explicitly expands a hidden LibreOffice path and writes a macro file there. The context is legitimate recalculation, but the filesystem side effect is confirmed.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (3)
Low
recalc.py:37
False Positive: XML Namespace URL Is Not Network Access
The hardcoded URL is inside the LibreOffice macro XML namespace. No evidence found that recalc.py performs HTTP requests, opens sockets, or sends workbook data to a remote service.
Line 37 is static XML metadata, not executable network code. No network library or request path appears in the reviewed files.
Low
SKILL.md:71SKILL.md:78-92SKILL.md:100-125SKILL.md:135-146SKILL.md:150-175SKILL.md:179-215SKILL.md:234-260SKILL.md:270-277SKILL.md:283-284
False Positive: Markdown Examples Flagged as Shell Execution
Most SKILL.md external command and reconnaissance hits are fenced Python, Bash, JSON, inline spreadsheet examples, or code style guidance. They document spreadsheet workflows and do not execute during skill loading.
The referenced lines are documentation snippets, spreadsheet references, or style guidance. The only operational command they instruct is the expected recalc.py usage.
Low
SKILL.md:3SKILL.md:55SKILL.md:76SKILL.md:88SKILL.md:104-112SKILL.md:121
False Positive: Weak Crypto and C2 Keyword Matches
The weak-crypto and C2 hits occur in prose, spreadsheet cell references, or example formulas such as C2. No evidence found of cryptographic APIs, command-and-control logic, or obfuscated traffic.
The cited lines contain spreadsheet instructions and examples, not security primitives or network control behavior. This strongly supports a scanner keyword false positive.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable