ClawHub
Back to skill

Security audit

Excel Export

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently creates Excel workbooks from JSON, with disclosed formula and locale behavior, but users should only generate formula-containing workbooks from trusted specs.

Install this if you need JSON-to-Excel export with Moroccan/French defaults. Pin xlsxwriter in your own environment if reproducibility matters, and do not accept workbook JSON specs with formulas from untrusted parties because formulas may run or fetch external content when opened in a spreadsheet client.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/build_xlsx.py:162
Finding

Unrestricted spreadsheet formulas allow creation of active-content workbooks

Content
View full analysis

Vulnerability Details

File Location: scripts/build_xlsx.py:162-163 and scripts/build_xlsx.py:439-440
Vulnerability Type: Arbitrary spreadsheet formula injection
Risk Level: Medium

The relevant validation and rendering code is:

python
if c.get("formula") is not None and not isinstance(c["formula"], str):
    die(f"{tag}: 'formula' must be a string")
python
if col.get("formula"):
    td["formula"] = col["formula"]

Technical Analysis

The validator only confirms that a supplied formula is a string. It does not parse the expression, restrict it to local structured references, or reject potentially dangerous constructs such as external workbook references, URLs, DDE-style expressions, or network-capable spreadsheet functions.

The formula is subsequently passed unchanged to XlsxWriter and embedded in the generated workbook. Consequently, anyone who controls or influences the input JSON specification can control active formula content in the resulting XLSX file.

The Python process does not execute the formula itself. Exploitation occurs when a recipient opens or recalculates the generated workbook in a spreadsheet client. The exact behavior depends on the client version, trust settings, protected-view configuration, and organizational policy. Modern clients may block dangerous behavior or display a warning, but the generator should not rely exclusively on recipient-side controls.

Attack Path

  1. An attacker gains the ability to provide or modify the JSON specification consumed through --input.
  2. The attacker places a malicious expression in a columns[].formula field.
  3. Validation accepts the value because it is a string.
  4. _render_sheet passes the expression directly to XlsxWriter as the table-column formula.
  5. The generated XLSX file is delivered to a user as a legitimate report.
  6. The recipient opens or recalculates the workbook.
  7. Depending on the spreadsheet client and its security configuration, the form ...[truncated 974 chars]
Remediation
View remediation

Remediation Suggestions

  1. Disable caller-supplied formulas by default when the JSON specification is not fully trusted.
  2. Add an explicit command-line option, such as --allow-formulas, so active content requires deliberate authorization.
  3. If formulas are required, parse them and permit only a narrowly defined grammar of local arithmetic and structured table references.
  4. Reject formulas containing external workbook references, URI schemes, DDE syntax, or other external-data constructs.
  5. Maintain a denylist as defense in depth for network-capable and legacy high-risk functions, while treating an allowlist parser as the primary control.
  6. Enforce a maximum formula length and reject control characters or malformed expressions.
  7. Record in the output summary whether active formulas were embedded.
  8. Document that workbooks containing formulas should only be generated from trusted specifications and should be opened under protected-view and external-content restrictions.
  9. Add automated tests demonstrating rejection of external references, URLs, DDE-style payloads, and unsupported functions.

T08 · Insecure Dependencies

Note
Location
SKILL.md:14
Finding

Unpinned third-party dependency produces a mutable installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:14-17
Vulnerability Type: Unpinned package installation
Risk Level: Low

The documented installation procedure is:

bash
python3 -m venv ~/.openclaw/workspace/.venv_excel
~/.openclaw/workspace/.venv_excel/bin/pip install xlsxwriter

Technical Analysis

The setup instructions install xlsxwriter without a fixed version or package hash. Package resolution therefore depends on the latest version available from the configured Python package index at installation time.

This creates a mutable, non-reproducible dependency boundary. A future compromised release, package-index compromise, altered index configuration, or incompatible upstream release could cause installations to retrieve code that was not reviewed with this project.

There is no evidence in the reviewed project that the named package is currently malicious. The weakness is the absence of version and integrity controls around third-party code installation.

Attack Path

  1. An operator follows the documented setup instructions.
  2. pip resolves xlsxwriter from the environment’s configured package index.
  3. Because no version or hash is specified, the package selected at that time may differ from the version originally tested or audited.
  4. If the selected distribution or package source has been compromised, its installation or imported runtime code executes with the operator’s permissions.
  5. The compromised dependency could affect workbook generation or access data available to the process.

Impact Assessment

Any malicious dependency code would run with the same operating-system privileges as the user executing pip or build_xlsx.py. Its potential scope could include:

  • Reading input JSON and generated workbook data.
  • Modifying generated files.
  • Accessing other files available to the invoking account.
  • Making network connections if permitted by the host.
  • Executing additional code within the user’s security con ...[truncated 298 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin XlsxWriter to a reviewed, tested version in a dependency file, for example:
text
XlsxWriter==REVIEWED_VERSION
  1. Generate and verify distribution hashes, then install with hash enforcement:
bash
python -m pip install --require-hashes -r requirements.txt
  1. Commit the lock file or requirements file to the project so installations are reproducible.
  2. Use the official Python package index or an organization-controlled mirror with restricted publishing and retention policies.
  3. Configure automated dependency vulnerability and provenance scanning.
  4. Review and deliberately update the pinned version rather than resolving the latest release during routine setup.
  5. Where supported, retain package metadata or attestations so the downloaded artifact can be traced to the reviewed release.
  6. Avoid running package installation or workbook generation with elevated privileges.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md
1. **Preserve data types.**  Leading-zero strings, phone numbers (`+212…`), and numeric strings longer than 15 digits are always stored as text.  Excel silently corrupts these if written as numbers.

2. **Keep calculations in Excel.**  When the workbook should stay live, write formulas — not hardcoded derived values from Python.  Use structured references so formulas survive row insertions and deletions.

3. **Treat dates explicitly.**  Dates are serial numbers with legacy quirks.  The script writes real date objects with explicit `dd/mm/yyyy` formatting — never raw serial numbers or ambiguous strings.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation states that regional defaults are always French/Morocco, including date, currency, and boolean rendering. This is a natural-language locale policy constraint presented as mandatory behavior, with no user choice or opt-in mechanism described.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document specifies that boolean values render as 'Oui' / 'Non', and later examples use French sheet titles and headers throughout. Because the file presents these locale choices as defaults without opt-in or documented regional justification, it violates the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The module docstring states that the skill produces workbooks with 'French / Morocco formatting defaults', and the implementation renders boolean values as 'Oui / Non' and uses Morocco-specific currency formatting. This imposes a specific language/locale on all outputs without offering a user choice or documenting an opt-in mechanism.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.