Back to skill
Skillv0.1.0
ClawScan security
xlsx · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 15, 2026, 6:11 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code, instructions, and requirements are coherent with its spreadsheet recalculation and editing purpose; it does not request unrelated credentials or network access, but it does write a LibreOffice macro into the user's profile which you should review before granting use.
- Guidance
- This skill appears to do what it says: create/edit spreadsheets, use formulas, and run LibreOffice to recalculate. Before installing or running it: (1) review recalc.py and the macro content (Module1.xba) — the macro is short and benign but it will be written persistently into your LibreOffice profile; (2) ensure you are comfortable allowing the skill to invoke soffice and (optionally) timeout/gtimeout on your machine; (3) backup your LibreOffice user profile/macros if you want an easy rollback; (4) run the script in a sandbox or test environment the first time to confirm behavior; (5) note there is a minor bug/odd logic in the script's error handling (could produce confusing error messages) — this is an implementation issue, not an indicator of malicious behavior. If you are uncomfortable with any persistent changes to your LibreOffice profile, do not install or run the skill until you have inspected and optionally modified recalc.py to avoid writing the macro automatically.
Review Dimensions
- Purpose & Capability
- okName/description (xlsx spreadsheet creation/editing/recalculation) align with included SKILL.md and the recalc.py script. The script and docs use openpyxl/pandas and LibreOffice for recalculation, which are appropriate for the stated tasks.
- Instruction Scope
- okSKILL.md instructs the agent to read/write .xlsx files, use pandas/openpyxl for manipulation, and run recalc.py to recalculate formulas. The instructions reference only spreadsheet files and LibreOffice; they do not ask the agent to read unrelated system files or exfiltrate data.
- Install Mechanism
- okThere is no install spec (instruction-only) and the included code is a small Python script. The script invokes local binaries (soffice, timeout/gtimeout) but does not download or execute code from remote URLs.
- Credentials
- okThe skill requests no environment variables, credentials, or config paths in metadata. The script does create and write a macro file under the user's LibreOffice profile directory, which is proportionate to its stated goal of configuring LibreOffice for recalculation.
- Persistence & Privilege
- noteThe recalc.py script writes a LibreOffice macro file into the user's profile (~/.config/libreoffice/... or ~/Library/Application Support/LibreOffice/...), which persists across runs and affects the user's LibreOffice environment. While necessary for the feature, this is a persistent change to a user application and should be reviewed.