Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
lhx11
v1.0.0Comprehensive spreadsheet creation, editing, and analysis with support for formulas, formatting, data analysis, and visualization. When Claude needs to work...
⭐ 0· 103·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's stated purpose is spreadsheet creation/editing/recalculation, which matches the included recalc.py and SKILL.md guidance. However, SKILL.md explicitly requires LibreOffice (soffice) to be present and the recalc.py uses it; the skill manifest declares no required binaries or config paths. That mismatch (requiring and modifying LibreOffice config without declaring it) is incoherent and should be explained by the author.
Instruction Scope
The runtime instructions direct the agent to run the bundled recalc.py which will create a LibreOffice macro file under the user's home config (~/.config/libreoffice/... or macOS Library path) and execute soffice headless to perform recalculation. Modifying user application configuration is beyond merely reading/writing an Excel file and is not called out in the skill metadata or permission list.
Install Mechanism
This is an instruction-only skill with one included script; there is no remote download/install step or external package installation specified. No high-risk install URLs or archive extraction are present.
Credentials
The skill declares no required environment variables or config paths, yet recalc.py reads/writes files under the user's home directory (LibreOffice macro directories) and executes system binaries (soffice, optional timeout/gtimeout). Those filesystem and binary accesses are not reflected in the manifest and are broader than the declared requirements.
Persistence & Privilege
recalc.py will create a persistent LibreOffice macro file (Module1.xba) in the user's LibreOffice user macro directory on first run. That is a persistent modification of user application config (potentially affecting future LibreOffice runs) and is not disclosed in metadata; the skill does not request explicit permission for such persistent changes.
What to consider before installing
Before installing or enabling this skill, consider the following:
- The recalc.py script will write a LibreOffice macro into your user profile (~/Library/Application Support/LibreOffice/... on macOS or ~/.config/libreoffice/... on Linux). This modifies your LibreOffice configuration persistently. If you do not want persistent changes, do not run the script or run it in a disposable/sandbox environment.
- The SKILL.md says LibreOffice (soffice) is required, but the skill metadata does not declare any required binaries or config paths. Verify LibreOffice is installed and review the macro content (Module1.xba) yourself before allowing the skill to run.
- The script invokes system commands (soffice, timeout/gtimeout). Running it will execute those binaries with the file you provide — consider running the script on copies of files and back up your LibreOffice profile first.
- There are no network calls in the code, but the skill will modify local config. If you need stronger assurances, ask the author to: (1) document and declare required binaries/config paths in the metadata, (2) provide an option to run recalculation without writing a persistent macro, or (3) implement a non-persistent invocation method.
- Note the LICENSE claims Anthropic ownership while the skill owner is unknown; check licensing/usage implications if you intend to distribute or retain copies.
If you are not comfortable with these persistent local changes, run the tool manually in an isolated environment or ask the skill author to remove the persistent macro-writing behavior and instead use a transient invocation pattern.Like a lobster shell, security has layers — review code before you run it.
latestvk97awbhwqn3n0hydzgsy505wah8332g2
License
MIT-0
Free to use, modify, and redistribute. No attribution required.