{
  "schemaVersion": 1,
  "skillId": "anthropic-xlsx",
  "reviewedOn": "2026-10-19",
  "revision": "dbd4588f9e1033efb41dad4bef2f7947c8993d44",
  "status": "completed-bounded-source-review",
  "mode": "manual-source-review",
  "scope": "Manual review of formula/cache guidance, per-skill terms, external-link checks, profile handling, error scanning and exit-code behavior. Runtime not run.",
  "runtime": {
    "status": "not-run",
    "reason": "License boundary: pinned terms restrict copying outside Anthropic Services; this pass does not establish permission for this execution context. LibreOffice also unavailable",
    "actualHelperCalls": 0,
    "workflowExecutions": 0
  },
  "countMeaning": "Counts are manual source-review expectations, not executed tests or a runtime score.",
  "environment": {
    "method": "Manual source reading; no upstream code imported or executed"
  },
  "commands": [
    "Read pinned entrypoint, per-skill license and named helper control flow; record findings without executing the upstream skill."
  ],
  "controls": [
    "Public source only; no proprietary helper execution; no published upstream source"
  ],
  "isolationLimits": [
    "No runtime isolation was tested because runtime was not run"
  ],
  "findings": [
    {
      "severity": "attention",
      "title": "Runtime not run: restrictive per-skill terms",
      "detail": "The pinned XLSX license subjects the skill to Anthropic-service agreements and adds restrictions on outside copies, derivatives and redistribution. No XLSX helper was imported or executed here. LibreOffice was also unavailable in this evaluation environment."
    },
    {
      "severity": "attention",
      "title": "Recalculation rewrites the workbook",
      "detail": "Source review confirms that recalc.py opens a fresh LibreOffice profile, installs a recalculation macro there and saves the workbook in place. Its external-link check refuses one documented loss condition unless --force is supplied; charts and conditional-format references are explicitly outside that check's completeness claim."
    },
    {
      "severity": "attention",
      "title": "An error-free process exit is not an error-free workbook",
      "detail": "The script exits nonzero only when the JSON contains an error key. A result with status errors_found exits zero. Read status and total_errors explicitly, and validate the formulas against expected business results."
    },
    {
      "severity": "attention",
      "title": "Error scanning also matches ordinary text",
      "detail": "The source scanner searches for error tokens inside every string cell without checking Excel's cell error type. Text that discusses an error such as #REF! can be counted as a formula error. This is a source trace, not a workbook runtime reproduction."
    }
  ],
  "limitations": [
    "Runtime not run because of the per-skill license boundary; LibreOffice was unavailable too. Source review does not establish successful recalculation or document safety.",
    "No Excel/LibreOffice compatibility, macros, external-link recovery, chart preservation, numerical correctness or real business model was tested.",
    "One bounded pass at one pinned revision; no model-effectiveness baseline, repeated trials, security certification or assurance about future versions.",
    "No private files, credentials, authenticated accounts, paid requests or real customer workflows. Transitive dependencies and current vulnerability advisories were not audited."
  ],
  "cases": [
    {
      "id": "xlsx-license-boundary",
      "mode": "manual-source-review",
      "expectation": "Resolve the per-skill license before choosing an execution method",
      "passed": true,
      "observed": {
        "basis": "Manual reading and control-flow trace; no helper executed",
        "detail": "The proprietary per-skill terms differ from neighboring Apache-licensed skills. Runtime execution was withheld rather than borrowing another folder's license."
      },
      "sourceEvidence": {
        "sourceUrl": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/xlsx/LICENSE.txt",
        "symbol": "LICENSE and ADDITIONAL RESTRICTIONS"
      }
    },
    {
      "id": "xlsx-runtime-dependencies",
      "mode": "manual-source-review",
      "expectation": "Distinguish formula storage from actual formula recalculation",
      "passed": true,
      "observed": {
        "basis": "Manual reading and control-flow trace; no helper executed",
        "detail": "The entrypoint distinguishes openpyxl formula strings and cached values, requires a separate LibreOffice recalculation step, and warns that newer Excel functions may not survive its runtime."
      },
      "sourceEvidence": {
        "sourceUrl": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/xlsx/SKILL.md",
        "symbol": "Recalculate; Choosing formulas that survive verification"
      }
    },
    {
      "id": "xlsx-external-links",
      "mode": "manual-source-review",
      "expectation": "Trace the scope and bypass of the external-link protection",
      "passed": true,
      "observed": {
        "basis": "Manual reading and control-flow trace; no helper executed",
        "detail": "The helper first requires xl/externalLinks entries, then looks for uncached external-cell formulas and defined-name references. --force bypasses this check; the diagnostic warns charts and conditional formats may be missed."
      },
      "sourceEvidence": {
        "sourceUrl": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/xlsx/scripts/recalc.py",
        "symbol": "external_links_at_risk; recalc"
      }
    },
    {
      "id": "xlsx-write-and-profile",
      "mode": "manual-source-review",
      "expectation": "Identify how profile state and workbook mutation are handled",
      "passed": true,
      "observed": {
        "basis": "Manual reading and control-flow trace; no helper executed",
        "detail": "A temporary LibreOffice profile receives a Basic recalculation macro. The input file is saved in place. A clean process exit with an unchanged timestamp/size is returned as an error. No macro or LibreOffice process ran here."
      },
      "sourceEvidence": {
        "sourceUrl": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/xlsx/scripts/recalc.py",
        "symbol": "setup_libreoffice_macro; _recalc_with_profile"
      }
    },
    {
      "id": "xlsx-status-contract",
      "mode": "manual-source-review",
      "expectation": "Determine what callers must inspect after process exit",
      "passed": true,
      "observed": {
        "basis": "Manual reading and control-flow trace; no helper executed",
        "detail": "main exits one for an error key and zero for errors_found. Consumers must inspect the status and total_errors fields. The source explicitly documents this distinction."
      },
      "sourceEvidence": {
        "sourceUrl": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/xlsx/scripts/recalc.py",
        "symbol": "main"
      }
    },
    {
      "id": "xlsx-error-cell-types",
      "mode": "manual-source-review",
      "expectation": "Separate error-typed spreadsheet cells from ordinary text mentioning an error",
      "passed": false,
      "observed": {
        "basis": "Manual reading and control-flow trace; no helper executed",
        "detail": "The scanner uses substring matching on all string cell values, including prose, without checking cell.data_type. A prose cell mentioning #REF! follows the counting branch by inspection; no workbook was executed."
      },
      "sourceEvidence": {
        "sourceUrl": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/xlsx/scripts/recalc.py",
        "symbol": "_recalc_with_profile error scanning loop"
      }
    }
  ],
  "results": {
    "passed": 5,
    "failed": 1,
    "total": 6
  },
  "sourceManifest": [
    {
      "path": "skills/xlsx/SKILL.md",
      "sha256": "6712b39718fe815054abca9c3ee72f989613e6f771c8a5c58f30a65a6c905622",
      "gitBlob": "9da54804cc8c938586f89363c8da3b3a6e2a563d",
      "sourceUrl": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/xlsx/SKILL.md"
    },
    {
      "path": "skills/xlsx/LICENSE.txt",
      "sha256": "79f6d8f5b427252fa3b1c11ecdbdb6bf610b944f7530b4de78f770f38741cfaa",
      "gitBlob": "c55ab42224874608473643de0a85736b7fec0730",
      "sourceUrl": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/xlsx/LICENSE.txt"
    },
    {
      "path": "skills/xlsx/scripts/recalc.py",
      "sha256": "66f6e726d5a53cfabea0b6471d6669deb95e54e96cb7913b687e4388da1bb3d9",
      "gitBlob": "6232be2deea56cc97c1d8996e4d68adf2457059c",
      "sourceUrl": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/xlsx/scripts/recalc.py"
    },
    {
      "path": "skills/xlsx/scripts/office/soffice.py",
      "sha256": "df2c8d7249c132a4512d744482e4b5ed0ecbe885f0bcfb1295e7e6a7ced0432c",
      "gitBlob": "0b4c99deca54013c550458c9244ee63eea748dca",
      "sourceUrl": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/xlsx/scripts/office/soffice.py"
    }
  ],
  "baseline": {
    "status": "not-run",
    "reason": "No model-effectiveness comparison or workflow-quality claim"
  },
  "repetitions": 0
}