Xlsx Pro

Compétence pour manipuler les fichiers Excel (.xlsx, .xlsm, .csv, .tsv). Utiliser quand l'utilisateur veut : ouvrir, lire, éditer ou créer un fichier tableur ; ajouter des colonnes, calculer des formules, formater, créer des graphiques, nettoyer des données ; convertir entre formats tabulaires. Le livrable doit être un fichier tableur. NE PAS utiliser si le livrable est un document Word, HTML, script Python standalone, ou intégration Google Sheets.

This skill appears to do what it says (create/edit XLSX and optionally recalc via LibreOffice), but it performs operations with real side effects: it writes a LibreOffice macro into your user profile and may compile an LD_PRELOAD .so shim in /tmp. Before installing or running: 1) Inspect the files yourself (scripts/recalc.py, scripts/office/soffice.py and the shim C source in the repo) to verify you accept the actions. The macro content is visible in the repo (RecalculateAndSave), but writing macros modifies your LibreOffice profile. 2) Run the tool on copies of your files and not on irreplaceable data; back up templates. 3) If you are uncomfortable with compiling/running native code or installing LibreOffice macros on your account, run the skill inside an isolated environment or container. 4) Confirm you trust the unknown source/owner (no homepage provided). 5) If you approve usage but want minimal impact, consider editing recalc.py to skip macro installation and instead manually perform the LibreOffice recalculation in a controlled manner. If you want a safer install, request the author to provide an opt-in path that does not auto-write macros or compile LD_PRELOAD code.

Type: OpenClaw Skill Name: xlsx-pro Version: 1.0.1 This skill is classified as suspicious due to its use of high-risk system-level capabilities, specifically the runtime compilation of C code using `gcc` and the subsequent use of `LD_PRELOAD` to inject a custom shared library (`lo_socket_shim.so`) into processes. These actions, found in `scripts/office/soffice.py`, are intended to enable LibreOffice to function in sandboxed environments by shimming AF_UNIX socket calls. While the stated purpose is functional and there is no clear evidence of malicious intent, these techniques are powerful and could be exploited if the skill's environment or the hardcoded C source were compromised, representing a significant attack surface.