ClawHub
Back to skill

Security audit

Spreadsheet Engineering

Security checks for vulnerabilities and agentic risk

Overview

This spreadsheet-engineering skill is a documentation-only guide whose automation examples are relevant to its purpose, though users should handle email and row-deletion snippets carefully.

Install only if you want a spreadsheet methodology guide with formula, dashboard, and automation examples. Before copying the email or archive scripts into real business sheets, verify recipients, data sensitivity, permissions, backups, and recovery options.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill includes a ready-to-use Apps Script that emails spreadsheet-derived KPI values externally via MailApp.sendEmail, but it does not warn users about data exfiltration, recipient validation, or sensitivity of the transmitted metrics. In a spreadsheet-engineering skill, this is more dangerous because users may copy the automation verbatim into business reporting workflows and unintentionally send confidential operational or financial data outside approved channels.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The archiveOldRows example automatically appends rows to an archive sheet and then deletes them from the source sheet without warning that the deletion is destructive and may be irreversible if versioning or backups are not in place. In this context, users are being taught operational spreadsheet automation, so omission of safeguards increases the chance of accidental data loss in production spreadsheets.

Static analysis

No suspicious patterns detected.