Refuted findings 14
Candidates the review stage examined and rejected, kept for transparency.
Code execution
criticalRefutedmedium confidenceThe skill's create.md instructs the agent to execute the bundled scripts scripts/bake.py and scripts/audit.py on every saved workbook; the scripts' contents are not present in the reviewed units, so this is an unverified bundled-code execution instruction rather than a confirmed harmful chain.
python scripts/bake.py model.xlsx
Why it was refuted
Invoking bake.py and audit.py after saving is the toolkit's declared recalc-and-validate QA workflow (the description's 'sanity-check this xlsx' / 'compute the totals as formulas'), openly documented in SKILL.md's command list with each script's behavior described and the agent directed to read every bundled script, so this falls under the declared-core-capability carve-out rather than unreviewed execution risk.
Code execution
criticalRefutedmedium confidenceThe skill's edit.md instructs the agent to execute the bundled scripts/explode.py to unpack a workbook into a directory, and the script's content is not shown in the reviewed units.
python scripts/explode.py input.xlsx unpacked/
Why it was refuted
The finding's premise is false: explode.py's content is in the reviewed units and is a plain zipfile extraction with a documented, flag-guarded --force, and the unpack→edit→repack workflow it serves is explicitly declared in the skill's decision matrix.
Code execution
criticalRefutedmedium confidenceThe skill's edit.md instructs the agent to execute the bundled scripts/assemble.py, scripts/audit.py, and scripts/bake.py to repack and validate the edited workbook; none of the scripts' contents are visible in the reviewed units.
python scripts/assemble.py unpacked/ output.xlsx
Why it was refuted
The repack-and-validate invocation is the declared 'Unpack → edit XML → repack' workflow, and the reviewed units document what the scripts do (assemble.py rebuilds the ZIP, audit.py confirms parsing, SKILL.md documents bake.py), making this openly declared core capability rather than concealed bundled execution.
Code execution
criticalRefutedmedium confidenceThe skill's edit.md instructs the agent to always execute the bundled scripts/bake.py and scripts/audit.py after each edit; the scripts' contents are not visible in the reviewed units.
python scripts/bake.py output.xlsx
Why it was refuted
The always-run bake/audit step is the declared recalc-and-validate QA flow, documented command-by-command in SKILL.md's common commands section, which is the declared-core-capability carve-out.
Code execution
criticalRefutedlow confidenceThe skill's read.md reader-selection table points the agent at the bundled scripts/csv_out.py for plain-text output, directing execution of code whose content is not visible in the reviewed units.
Just want plain-text output for grep / prompting | `scripts/csv_out.py`
Why it was refuted
The table row is the declared 'export sheet 2 to CSV' capability and declares the script's behavior itself ('One CSV per sheet, only needs openpyxl'), with the same command documented in SKILL.md, so nothing here is undeclared or beyond the core capability.
Code execution
criticalRefutedmedium confidenceThe skill's read.md instructs the agent to execute the bundled scripts/csv_out.py to export each sheet to CSV; the script's content is not visible in the reviewed units.
python scripts/csv_out.py input.xlsx out_dir/
Why it was refuted
Running csv_out.py for per-sheet CSV export is the declared CSV-export capability, documented in both SKILL.md's command list and read.md's own 'CSV (one per sheet)' section.
Code execution
criticalRefutedmedium confidenceThe skill's read.md instructs the agent to execute the bundled scripts/pdf_out.py and to consult scripts/runtime/libreoffice.py (a LibreOffice wrapper) for PDF export; neither script's content is visible in the reviewed units.
python scripts/pdf_out.py input.xlsx
Why it was refuted
PDF export is the declared 'render the workbook as PDF' capability, and the premise that neither script's content is visible is half false — the libreoffice.py wrapper is in the reviewed units as a validated, fall-through binary lookup feeding a timeout-bounded subprocess.run.
Code execution
criticalRefutedmedium confidenceThe skill's read.md instructs the agent to execute the bundled scripts/overview.py to summarize a workbook; the script's content is not visible in the reviewed units.
python scripts/overview.py input.xlsx
Why it was refuted
overview.py's purpose and output are documented both in SKILL.md ('Describe a workbook (sheets, dimensions, formula count, sample rows)') and in read.md itself ('Outputs JSON with sheet names, dimensions, dtype guesses, and a small sample.'), making this the declared read/summarize capability rather than unreviewed execution.
Code execution
criticalRefutedmedium confidenceThe skill's read.md tells the agent to run the bundled scripts/audit.py whenever openpyxl fails on a workbook, directing execution of code whose content is not visible in the reviewed units.
If openpyxl fails on a file, run `scripts/audit.py`
Why it was refuted
audit.py's validation role is documented in SKILL.md's command list and the sentence is recorded as declared capability claims D27/D28, so running it when openpyxl fails is the declared sanity-check capability, not unreviewed execution.
Code execution
criticalRefutedmedium confidenceThe skill's read.md tells the agent to run the bundled scripts/bake.py before pandas reads so cached formula values exist; the script's content is not visible in the reviewed units.
formula cells come back as `None`. Run `scripts/bake.py` first.
Why it was refuted
Running bake.py before pandas reads is the declared recalc capability ('compute the totals as formulas'), documented in SKILL.md's command list and recorded as declared capability claim D23.
Destructive action
criticalRefutedlow confidencescripts/explode.py recursively deletes the caller-specified destination directory with shutil.rmtree when --force is passed and the directory is non-empty, so an arbitrary path handed to explode can be wiped rather than only an extraction scratch directory.
shutil.rmtree(target)
Why it was refuted
The rmtree is a documented, doubly-guarded overwrite of the caller-specified extraction destination: it only fires when the directory is non-empty AND --force was passed, otherwise it raises FileExistsError, and the CLI help declares the overwrite — accepted, flag-guarded scratch-directory cleanup rather than an unguarded destructive path.
Code execution
criticalRefutedlow confidenceThe LibreOffice runtime helper resolves the executable from the MIMO_SOFFICE environment variable before any fallback and launches it via subprocess during bake/PDF workflows, so the environment rather than the artifact decides which binary executes.
os.environ.get(＂MIMO_SOFFICE＂)
Why it was refuted
MIMO_SOFFICE is the platform's documented bundled-LibreOffice hook ('exposed as MIMO_SOFFICE and picked up automatically'), validated with is_file() and falling through to PATH and standard install locations before launching LibreOffice for the declared PDF/recalc workflows, so the env hook is accepted runtime integration, not an artifact-chosen binary channel.
Code execution
criticalRefutedlow confidenceSKILL.md instructs the agent to switch its interpreter for all bundled commands to whatever binary the MIMO_PYTHON environment variable names whenever that variable is set, a conditional execution path whose target the artifact does not pin or validate.
when the `MIMO_PYTHON` environment variable is set, skip the pip installs below
Why it was refuted
The MIMO_PYTHON branch is the skill's openly documented bundled-runtime mechanism — the same sentence declares it (recorded as declared capability claims D2/D3) and notes the dependencies are preinstalled in that platform-provided interpreter — and honoring a deployment-set env var requires the same control as PATH trust, so this is accepted runtime integration for the declared spreadsheet workflows, not an undeclared or unpinned execution channel.
Supply chain
highRefutedlow confidenceThe setup section instructs the agent to install unpinned packages via `pip install --upgrade` and, conditionally on the environment variable MIMO_PYTHON being set, to run all bundled scripts through whichever interpreter binary that variable names, an execution path not covered by the skill's declared description.
when the `MIMO_PYTHON` environment variable is set, skip the pip installs below
Why it was refuted
Line 33 tells the agent to skip the pip installs under the bundled runtime, not to perform them, and the conditional $MIMO_PYTHON execution path is explicitly declared in that same sentence and recorded as declared capability claims D2/D3, so the finding's premise that it is 'not covered by the skill's declared description' is contradicted by the artifact itself.
