Security audit
Security checks for vulnerabilities and agentic risk
The skill is rated suspicious because scanners report an unsafe temporary-library loading path and substantial Word and PowerPoint functionality outside its stated Excel purpose.
Consider the verdict's unsafe temporary-library loading concern and the mismatch between the declared Excel purpose and the reported Word and PowerPoint workflows before installing. Skillspector coverage was partial: 50 of 55 components were scanned, and several instruction-pattern checks could not fully evaluate five components, so the evidence is incomplete.
scripts/soffice.pyPredictable shared temporary library is trusted and loaded through LD_PRELOAD
Attacker-supplied library initialization code can execute as the recalculation user, allowing access to that user's files and process environment and unauthorized modification of their data.
The supplied code has a materially different primary purpose: detecting untracked edits in Word documents. It does not implement Excel formulas, charts, pivot tables, formatting, or spreadsheet analysis. Temporary files and git diff support the Word validation workflow; they are not independently suspicious, but that workflow is not covered by the declared description.
The code explicitly targets PowerPoint package paths and checks conditions that cause PowerPoint to reject or discard charts. Although chart analysis is mentioned in the description, it is scoped to Excel spreadsheets, not PowerPoint presentations. This is a materially different target resource and purpose. The supplied chunk shows no network access, external file access, or automatic repair.
The supplied module explicitly implements PPTXSchemaValidator and operates on PowerPoint-specific namespaces and package paths. Its primary purpose is validating presentations, not creating, editing, or analyzing Excel spreadsheets. Chart validation here is presentation-specific and does not establish alignment with the declared Excel functionality. The visible code does not demonstrate malicious activity, but its document type and primary capability materially differ from the description.
The supplied module exposes validators for document and presentation processing rather than the declared Excel spreadsheet functionality. These are materially different capabilities, with no visible connection to supporting Excel operations. No resource access or permission use is shown.
The supplied module specifically targets WordprocessingML namespaces and Word document components such as document.xml, comments.xml, tracked insertions/deletions, and paragraph identifiers. It also writes repaired Word XML back to disk. These capabilities have a materially different purpose from the declared Excel functionality; no Excel formula, chart, pivot-table, or spreadsheet-formatting behavior is shown. This is a functional scope mismatch, not evidence of malicious behavior.
The supplied code has a materially different primary purpose from the declared Excel functionality. It implements document validation and repair workflows for Word and PowerPoint, while its Excel branch only prints a notice and exits without validating or editing spreadsheet content. No formula, chart, pivot-table, or formatting functionality is implemented in this chunk. The mismatch is functional scope, not evidence of malicious activity.
声明用途限定于 Excel 表格处理，而代码专门检查 ppt/ 下的 PowerPoint 母版、主题关系及演示文稿 XML 结构，属于实质不同的文档类型与分析用途。代码未实现 Excel 公式、图表、透视表或格式处理，也未显示文件写入、网络访问或其他外部副作用。
代码定义了针对 ppt/slides、slideLayouts、slideMasters 等 PowerPoint 部件的路径正则，以及针对幻灯片 XML 架构错误的匹配规则。函数仅判断错误消息是否属于架构校验结果，并筛选已知严重错误；未实现 Excel 公式、图表、透视表或格式处理。其主要用途与声明的 Excel 功能存在实质差异。该片段没有执行文件访问或修改操作。
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def get_soffice_env() -> dict:
env = os.environ.copy()
env["SAL_USE_VCLPLUGIN"] = "svp"
if _needs_shim():
The trigger lists at L11 and L19 include “做个表” (make a table) and “公式计算” (formula calculation). These can refer to Markdown tables, database tables, or ordinary mathematical calculations, but no exclusion or explicit Excel-context requirement prevents unintended activation.
Without declared permissions the skill's intent is opaque and cannot be validated.
In scripts/pptx_chart.py, L164-L170 implements chart diagnostics restricted by L016 to ppt/charts/chart*.xml. The checks enforce PowerPoint-specific label and axis behavior, rather than analyzing Excel workbook charts, so this capability is not justified by the manifest's Excel-only purpose.
In scripts/pptx_theme.py, L101-L114 exposes diagnostics for shared presentation master themes. These operate on PowerPoint slide, notes, and handout masters (L018-L020) and presentation element ordering (L066-L079), capabilities outside the manifest's stated Excel creation, editing, and analysis scope.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def has_gtimeout():
try:
subprocess.run(
["gtimeout", "--version"], capture_output=True, timeout=1, check=False
)
return True
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
timed_out = f"LibreOffice timed out after {timeout}s; formulas were NOT recalculated. Re-run with a longer timeout."
try:
result = subprocess.run(
cmd, capture_output=True, text=True, env=get_soffice_env(), timeout=timeout + 15
)
except subprocess.TimeoutExpired:
The argument-list subprocess call does not itself introduce shell injection, but its environment can preload an untrusted shared library. When the shim is needed, _ensure_shim accepts any existing lo_socket_shim.so at the predictable temporary path without checking ownership or provenance, allowing a local attacker to execute code with the conversion process's permissions.
tempfile.TemporaryDirectory(prefix="lo_profile_", ignore_cleanup_errors=True)
)
args = [f"-env:UserInstallation={Path(profile).as_uri()}"] + args
return subprocess.run(["soffice"] + args, env=get_soffice_env(), **kwargs)
The compiler invocation uses predictable source and output paths in a potentially shared temporary directory, without protection against precreated files, symlinks, or concurrent replacement. A local attacker with access to that directory could tamper with the compilation inputs or output, leading to malicious code being loaded through LD_PRELOAD, or cause writes through symlinks under the caller's permissions.
src = Path(tempfile.gettempdir()) / "lo_socket_shim.c"
src.write_text(_SHIM_SOURCE)
subprocess.run(
["gcc", "-shared", "-fPIC", "-o", str(_SHIM_SO), str(src), "-ldl"],
check=True,
capture_output=True,
The manifest describes creating, editing, and analyzing Excel spreadsheets. scripts/validate.py L124-L141 instead selects Word schema/tracked-change validators and PowerPoint validators, and L153-L158 can repair and rewrite those non-spreadsheet documents; these are independent document-editing capabilities rather than necessary Excel implementation details.
The XLSX branch exits with status zero without validating the workbook's XML or schema. Although it prints an explicit notice, an agent or automated pipeline using the exit status as a validation gate can incorrectly accept malformed or unchecked spreadsheets, making this particularly relevant to an Excel-focused skill.
The manifest describes creating, editing, and analyzing Excel spreadsheets, but scripts/validators_docx.py implements Word-specific validation and modification. At L409–L454, it repairs Word durableId attributes and writes the modified XML back to disk; this is not shared spreadsheet XML validation or an obvious requirement of Excel processing.
In scripts/validators_redlining.py, L38–L79 reads Word document.xml parts from modified and original DOCX documents, reverses new tracked changes in memory, and compares their text to detect untracked edits. This Word-specific review workflow is outside the manifest's stated Excel spreadsheet functionality.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
original_file.write_text(original_text, encoding="utf-8")
modified_file.write_text(modified_text, encoding="utf-8")
result = subprocess.run(
[
"git",
"diff",
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if content_lines:
return "\n".join(content_lines)
result = subprocess.run(
[
"git",
"diff",
L008–L009 explicitly require Chinese output throughout whenever the input is Chinese. This is a mandatory output-language constraint rather than merely a choice of reference documentation, and it provides no exception for a user requesting another output language.
The manifest describes creating, editing, and analyzing Excel spreadsheets. L12–L15 specifically identify PowerPoint slide, layout, master, and notes parts, while L17–L46 define fatal slide-validation errors consumed by the classifier at L53–L60; this is presentation-specific functionality rather than shared spreadsheet-format support.