Li Etl Handle Safe

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:22 AM UTC
• Version: 1.0.2

Overview

This spreadsheet-processing skill is mostly purpose-aligned, but it needs review because its lockfile uses unsecured third-party HTTP dependency URLs despite claiming official HTTPS sources, and its file-writing operations lack clear overwrite safeguards.

Review before installing. Prefer a version whose lockfile uses approved HTTPS package sources, refreshes or patches vulnerable dependencies, and documents safe defaults for overwrites, backups, row deletion, deduplication, and formula-safe CSV export. Use it only on trusted file paths and keep backups of important spreadsheets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: package-lock.json:18

Finding

Dependencies Retrieved from an Unencrypted Third-Party Registry Mirror

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:127

Finding

CSV Formula Injection Through Unsanitized Exported Cell Values

Content

View full analysis

Remediation

View remediation

Object.fromEntries( Object.entries(row).map(([key, value]) => [ neutralizeSpreadsheetFormula(key), neutralizeSpreadsheetFormula(value) ]) ) ); } ``` 5. Clearly document that neutralization changes the literal content of affected cells and allow callers to opt out only when all exported data is trusted. 6. Add regression tests covering dangerous prefixes, leading whitespace, headers, quoted values, and values containing delimiters or newlines. 7. Where practical, avoid opening exported files with spreadsheet features that automatically evaluate formulas or external links. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (16)

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

brace-expansion 1.1.12 is flagged with multiple denial-of-service issues involving pathological brace patterns that can trigger excessive CPU use, hangs, or memory exhaustion. Because this package is used transitively through glob/minimatch-style dependency chains, untrusted pattern input reaching those code paths could crash or stall the process.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

brace-expansion 2.0.2 carries the same class of denial-of-service vulnerabilities, allowing maliciously crafted brace expressions to cause exponential expansion, hangs, or out-of-memory conditions. In an ETL-related package, attacker-supplied file patterns or archive member selection logic could increase exposure if such inputs are user influenced.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: tmp==0.2.5 — 1 advisory(ies): CVE-2026-44705 (tmp has Path Traversal via unsanitized prefix/postfix that enables directory esc)

High

• Category: Supply Chain
• Confidence: 89% confidence

Finding

tmp 0.2.5 is reported vulnerable to path traversal when unsanitized prefix or postfix values are used to construct temporary paths. In a file-processing/ETL context, if attacker-controlled names influence temp file creation through exceljs or wrapper code, this could enable writes outside the intended temp directory or overwrite sensitive files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly exposes data-modifying operations such as writing files and deleting empty or duplicate rows, but it does not document overwrite protection, backup behavior, confirmation requirements, or data-loss warnings. In an agent context, this can lead to accidental destruction or replacement of user data if the skill is invoked on the wrong path or with overly broad cleaning rules.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language comments and skill description are entirely in Chinese, including the name and functional description, with no indication that the user can choose another language or that the tool is intended only for a Chinese-language context. Under the policy, forcing a specific language without opt-in is a locale/language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Lines L150-L155 describe cleanData as performing trimming and null-removal on row fields and returning cleaned data. However, in L159-L184 the function builds cleanedRow but never returns or stores it, so trims/null-field removals are discarded and the function effectively only removes some rows via filter.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This manifest enumerates many entrypoints such as readExcel, writeCSV, cleanData, and mergeFiles, but does not explain how or when they are selected, nor what distinguishes one trigger from another. For a manifest file, this lack of specificity can cause unintended or overly broad invocation because there are no negative examples, context limits, or explicit trigger conditions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language description and instructions are entirely in Chinese, which can impose a language requirement on users without any opt-in or alternative locale. The policy calls for flagging language or locale constraints unless the skill offers a choice or clearly justifies the restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The lockfile pins packages to a region-specific mirror over plain HTTP rather than the default trusted registry or a documented enterprise mirror. This weakens supply-chain trust by introducing an extra distribution point and allowing metadata/package retrieval to be intercepted or altered in transit, even though integrity hashes provide only partial mitigation.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==8.3.2 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low

• Category: Supply Chain
• Confidence: 73% confidence

Finding

uuid 8.3.2 is flagged for missing buffer bounds checks in certain versioned UUID generation APIs when a caller supplies a buffer. This is a real issue, but its exploitability depends on the application invoking the affected API variants with attacker-influenced buffer parameters; that is not evident from the lockfile alone.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The package description is written only in Chinese, which imposes a specific language in natural-language metadata without indicating user choice or a justified locale restriction. This matches the policy category for language or locale constraints that are not presented as optional or region-specific.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

Using a caret version range for exceljs allows newer compatible releases to be installed automatically, which can introduce supply-chain risk if a future release is compromised or contains a regression. In a skill that processes spreadsheets, dependency trust matters because parsing libraries handle attacker-controlled file content and run in the host environment.

Content

Scanner excerpt · package.json (reported line 20)May include surrounding context.

json

"author": "老李",
  "license": "MIT",
  "dependencies": {
    "exceljs": "^4.4.0",
    "csv-parser": "^3.0.0",
    "csv-stringify": "^6.5.0"
  },

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

Using a caret version range for csv-parser permits automatic adoption of later releases within the major version, increasing supply-chain exposure if an upstream package is hijacked or a bad release is published. Because CSV parsers process untrusted input, unexpected dependency changes can affect reliability and security in downstream environments.

Content

Scanner excerpt · package.json (reported line 21)May include surrounding context.

json

"license": "MIT",
  "dependencies": {
    "exceljs": "^4.4.0",
    "csv-parser": "^3.0.0",
    "csv-stringify": "^6.5.0"
  },
  "engines": {

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

Using a caret version range for csv-stringify makes builds non-reproducible over time and creates a low-severity supply-chain risk if a later allowed version becomes malicious or vulnerable. Although this file does not itself execute code, dependency resolution during installation can still change behavior without explicit review.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json

"dependencies": {
    "exceljs": "^4.4.0",
    "csv-parser": "^3.0.0",
    "csv-stringify": "^6.5.0"
  },
  "engines": {
    "node": ">=14.0.0"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The natural-language metadata and labels are presented exclusively in Chinese, which may impose a language expectation on users without offering an alternative or documenting that the skill is intentionally region-specific. Under the policy, forcing a specific language without user opt-in can be a locale/language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's console messages are written in Chinese throughout, including startup, progress, and success output. This imposes a specific language on users without opt-in or justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.