Pptx Anthropic

• Analyzed: May 11, 2026, 6:35 AM
• Findings: 1
• Version: 1.0.0
• Hash: 395f16e2d21c6d70148c6df861f9f12de3b918be008ed8083967cff249b27f9b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains a script, scripts/office/soffice.py, that performs runtime compilation of a C-based shim using gcc and executes it via LD_PRELOAD to intercept system calls (socket, listen, accept). While this is plausibly intended to allow LibreOffice to function in restricted environments by shimming AF_UNIX sockets, the use of runtime compilation and library injection represents a high-risk capability. The rest of the bundle, including the instructions in SKILL.md and the Python scripts for PPTX manipulation (e.g., scripts/add_slide.py, scripts/office/unpack.py), appears well-structured and aligned with the stated purpose, incorporating security best practices such as the use of defusedxml to mitigate XXE risks.