ClawHub
Back to skill

Security audit

lhx1112

Security checks for vulnerabilities and agentic risk

Overview

This spreadsheet skill is mostly purpose-aligned, but its recalculation helper makes persistent LibreOffice profile changes that are broader than a normal spreadsheet edit.

Review before installing if you use LibreOffice macros or rely on your LibreOffice profile. The skill does not show credential theft, network exfiltration, or intentional deception, but its recalculation helper can make lasting changes outside the target spreadsheet; a safer version would use an isolated temporary LibreOffice profile or require explicit consent before touching user macro files.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T06 · System Persistence

Warning
Location
recalc.py:17
Finding

Persistent LibreOffice Macro Installation Can Overwrite Existing User Macros

Content
View full analysis
Sub RecalculateAndSave() ThisComponent.calculateAll() ThisComponent.store() ThisComponent.close(True) End Sub ''' try: with open(macro_file, 'w') as f: f.write(macro_content) return True except Exception: return False ``` ### Technical Analysis The recalculation utility writes an application-level macro into the current user's persistent LibreOffice profile. On Linux, the destination is `~/.config/libreoffice/4/user/basic/Standard/Module1.xba`; on macOS, it is under `~/Library/Application Support/LibreOffice/4/user/basic/Standard`. The file is retained after the script exits and is consequently available to future ...[truncated 2620 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The documented behavior materially exceeds the declared purpose by instructing the agent to modify the user's LibreOffice profile and launch external LibreOffice subprocesses, while presenting itself as a general spreadsheet skill. This mismatch can bypass user expectations and review, making persistent local changes and code execution via external tooling more dangerous than the benign-seeming description suggests.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill describes workflows that read and write local files and invoke shell commands (python recalc.py ...) but does not declare any explicit tool scope or permissions boundaries. In an agent environment, this weakens least-privilege controls and can allow unintended file access or command execution if the skill is invoked in broader contexts than expected.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation text is extremely broad and covers nearly any spreadsheet-related task, increasing the chance the skill is invoked when simpler or safer handling would suffice. Because the skill also includes file modification and shell-based recalculation guidance, overbroad triggering expands exposure to those higher-risk actions unnecessarily.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

CRITICAL: Use Formulas, Not Hardcoded Values

Always use Excel formulas instead of calculating values in Python and hardcoding them. This ensures the spreadsheet remains dynamic and updateable.

❌ WRONG - Hardcoding Calculated Values

python

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script's documented purpose is formula recalculation, but it also performs undisclosed persistent host-level configuration changes by installing a LibreOffice macro. This violates least surprise and can undermine operator trust and security review because a file-processing helper should not silently alter global application behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script writes an application-level LibreOffice macro into the user's persistent profile, modifying host configuration outside the stated task of recalculating a spreadsheet. This creates lasting side effects, expands trust in future LibreOffice sessions, and could enable abuse or confusion around globally installed macros if untrusted files or later workflows interact with that environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code modifies LibreOffice user macro files without a clear warning or consent at the point of action. In an agent skill context, silent persistence is especially risky because users expect file transformation, not durable modification of local office-suite automation settings.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · recalc.py (reported line 32)May include surrounding context.

python
return True
    
    if not os.path.exists(macro_dir):
        subprocess.run(['soffice', '--headless', '--terminate_after_init'], 
                      capture_output=True, timeout=10)
        os.makedirs(macro_dir, exist_ok=True)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · recalc.py (reported line 85)May include surrounding context.

python
if platform.system() == 'Darwin':
            # Check if gtimeout is available on macOS
            try:
                subprocess.run(['gtimeout', '--version'], capture_output=True, timeout=1, check=False)
                timeout_cmd = 'gtimeout'
            except (FileNotFoundError, subprocess.TimeoutExpired):
                pass

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · recalc.py (reported line 93)May include surrounding context.

python
if timeout_cmd:
            cmd = [timeout_cmd, str(timeout)] + cmd
    
    result = subprocess.run(cmd, capture_output=True, text=True)
    
    if result.returncode != 0 and result.returncode != 124:  # 124 is timeout exit code
        error_msg = result.stderr or 'Unknown error during recalculation'

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The script launches external commands (soffice and later timeout/gtimeout) to perform recalculation, but there is no runtime notice that external processes will be started. The high-level description mentions LibreOffice, but it does not explicitly warn the user that the script will execute local subprocesses as part of its operation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.