lhx11

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:29 AM UTC
• Version: 1.0.0

Overview

The skill is for legitimate spreadsheet work, but formula recalculation can automatically create or reuse a persistent LibreOffice macro in the user's profile.

Review this skill before installing if you use LibreOffice locally. Formula recalculation may modify your LibreOffice user profile and leave a macro behind, so prefer running it in an isolated profile or on a disposable account, and use copies of important workbooks unless the skill is updated to require consent and avoid persistent macro changes.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Warning

• Location: recalc.py:20

Finding

Unsafe Persistent Installation and Reuse of a Global LibreOffice Macro

Content

View full analysis

Sub RecalculateAndSave() ThisComponent.calculateAll() ThisComponent.store() ThisComponent.close(True) End Sub ''' try: with open(macro_file, 'w') as f: f.write(macro_content) return True except Exception: return False ``` The resulting global macro is subsequently invoked as follows: ```python cmd = [ 'soffice', '--headless', '--norestore', 'vnd.sun.star.script:Standard.Module1.RecalculateAndSave?language=Basic&location=application', abs_path ] ``` ### Technical Analysis The script installs `Module1.xba` in LibreOffice's persistent per-user profile instead of creating an isol ...[truncated 2692 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: recalc.py:79

Finding

Recalculation Timeout Is Not Enforced on All Supported Platforms

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as a general spreadsheet capability, but the documented behavior includes running an external recalculation workflow and automatically configuring LibreOffice by writing a macro on first run. This mismatch is dangerous because users or higher-level orchestrators may invoke the skill assuming routine spreadsheet handling, while it performs local environment modification and code execution side effects not clearly disclosed in the core declaration.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill content clearly directs file reads/writes and shell execution (python recalc.py ...) but declares no explicit tool scope or permissions boundaries. In an agent environment, this can enable broader-than-expected filesystem and command execution behavior without policy guardrails or user visibility.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation description is extremely broad and could cause the skill to trigger for many spreadsheet-related requests, including read-only analysis tasks that do not need file mutation or shell execution. Over-broad routing increases the chance that powerful file-write and command behaviors are invoked in contexts where a safer, more limited tool would suffice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs execution of recalc.py and says it will automatically configure LibreOffice on first run, which implies local code execution and modification of user application configuration. Running scripts and installing/configuring macros without clear warning or consent materially raises the risk of persistence, environment tampering, and unexpected side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The examples demonstrate saving new spreadsheets and modifying existing workbooks without any user-facing disclosure that local files may be changed. In agent settings, silent mutation of user files can cause data loss, template corruption, or unintended overwrites, especially when users expect analysis rather than modification.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

CRITICAL: Use Formulas, Not Hardcoded Values

Always use Excel formulas instead of calculating values in Python and hardcoding them. This ensures the spreadsheet remains dynamic and updateable.

❌ WRONG - Hardcoding Calculated Values

python

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file presents itself as a spreadsheet recalculation utility, but it also modifies global LibreOffice configuration by creating or overwriting user macro files. In an agent skill context, this is more dangerous because the skill may be invoked automatically on user content, and hidden environment modification exceeds the apparent scope of the requested operation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script writes a persistent LibreOffice application macro into the user's profile, changing global application state outside the target spreadsheet. That creates an unexpected trust boundary violation: future LibreOffice sessions may invoke or retain this macro, and the skill modifies executable macro content in a location users would not expect from a file-recalculation helper.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code edits LibreOffice macro files under the user's profile without any explicit user-facing warning or consent, which is a problematic hidden side effect. Because macros are executable application artifacts, silently creating them can undermine user trust and may affect later document handling or security posture.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · recalc.py (reported line 32)May include surrounding context.

python

return True
    
    if not os.path.exists(macro_dir):
        subprocess.run(['soffice', '--headless', '--terminate_after_init'], 
                      capture_output=True, timeout=10)
        os.makedirs(macro_dir, exist_ok=True)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · recalc.py (reported line 85)May include surrounding context.

python

if platform.system() == 'Darwin':
            # Check if gtimeout is available on macOS
            try:
                subprocess.run(['gtimeout', '--version'], capture_output=True, timeout=1, check=False)
                timeout_cmd = 'gtimeout'
            except (FileNotFoundError, subprocess.TimeoutExpired):
                pass

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · recalc.py (reported line 93)May include surrounding context.

python

if timeout_cmd:
            cmd = [timeout_cmd, str(timeout)] + cmd
    
    result = subprocess.run(cmd, capture_output=True, text=True)
    
    if result.returncode != 0 and result.returncode != 124:  # 124 is timeout exit code
        error_msg = result.stderr or 'Unknown error during recalculation'

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The script invokes external executables like soffice, timeout, and gtimeout to perform recalculation, which is a safety-relevant shell/subprocess action. While subprocess use is part of the skill's purpose, the user-facing CLI output does not explicitly mention that external system commands will be launched.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.