Excel Workflow

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:17 PM UTC
• Version: 1.0.0

Overview

This Excel skill is broadly coherent, but it asks users to automatically upload spreadsheets to Google Drive with full Drive access and retain workbook metadata locally without clear consent or retention controls.

Install only if you are comfortable connecting rclone to Google Drive and uploading spreadsheet contents there. Prefer a dedicated Google account or isolated Drive, avoid full Drive scope if a narrower rclone scope works, and do not use this with sensitive financial, personal, or regulated spreadsheets unless you have reviewed where files and SQLite metadata are stored and how to delete them.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:86

Finding

Excessive Google Drive OAuth Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:86-94; duplicated in excel-workflow-skill-package/SKILL.md:86-94
Vulnerability Type: Excessive OAuth scope and violation of least privilege
Risk Level: Medium

Vulnerable Code Snippet:

bash

# Configure rclone with Google Drive
rclone config

text

Follow prompts:
- Name: `gdrive`
- Storage: `drive` (Google Drive)
- Scope: `1` (Full access)
- Auto config: `y` (opens browser for OAuth)

Technical Analysis

The documented workflow requires Google Drive synchronization for Excel files stored under gdrive:Excel/, but the setup instructions explicitly direct users to select OAuth scope 1, described as full access. This grants rclone access beyond the dedicated Excel directory and beyond the minimum permissions necessary for the stated backup workflow.

The OAuth token generated by this process is normally retained in the local rclone configuration. Any process or account capable of reading and using that token may consequently exercise the full permissions granted to rclone. Folder naming does not create an OAuth authorization boundary, so limiting normal operations to gdrive:Excel/ does not prevent a stolen or misused token from accessing unrelated Drive content.

Attack Path

1. A user follows the skill instructions and runs rclone config.
2. The user selects scope 1, granting full Google Drive access.
3. rclone stores the resulting OAuth credentials in its local configuration.
4. An attacker who compromises the host, gains access to the relevant user account, or obtains the rclone configuration extracts the token.
5. The attacker configures rclone or another compatible OAuth client with the token.
6. The attacker reads, modifies, uploads, moves, or deletes files outside the intended Excel/ directory, subject to the privileges granted by Google Drive.

Impact Assessment

Successful exploitation can expose th ...[truncated 344 chars]

Remediation

View remediation

Remediation Suggestions

1. Select the narrowest rclone-supported Google Drive scope that satisfies the workflow, preferably one limited to files created by the application.
2. Use a dedicated Google account or isolated Shared Drive containing only workflow data if a sufficiently narrow folder-level OAuth scope is unavailable.
3. Avoid recommending full Drive access as the default. If it is unavoidable, clearly describe the security implications and require explicit user confirmation.
4. Protect the rclone configuration with restrictive filesystem permissions and ensure it is not included in backups, logs, repositories, or support bundles.
5. Document how users can inspect authorized applications, revoke the OAuth grant, and rotate credentials after suspected compromise.
6. Apply the same changes to both copies of SKILL.md to prevent the insecure setup instructions from remaining in the packaged duplicate.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:74

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:74-80 and SKILL.md:475-481; duplicated in excel-workflow-skill-package/SKILL.md:74-80 and excel-workflow-skill-package/SKILL.md:475-481
Vulnerability Type: Unpinned and non-reproducible dependency installation
Risk Level: Low

Vulnerable Code Snippets:

bash

# Install rclone (macOS)
brew install rclone

# Python packages (installed in venv automatically)
pip install openpyxl

bash

# Install in virtual environment
cd ~/.openclaw/tools/openclaw-excel
python3 -m venv venv
./venv/bin/pip install openpyxl

Technical Analysis

The installation instructions install openpyxl without a version constraint, lockfile, or package hash. Consequently, the code installed depends on the package versions available from the configured Python package index at installation time. This prevents reproducible deployment and permits future, unreviewed releases and transitive dependencies to enter the environment automatically.

The documented pip commands also rely on the user's active package-index configuration. If that configuration points to a compromised or untrusted mirror, the installation may retrieve altered artifacts. The audit did not identify a malicious package name or unsafe custom source in the artifact; the risk arises from accepting mutable, unverified dependency content.

Attack Path

1. A user follows the documentation and executes pip install openpyxl or ./venv/bin/pip install openpyxl.
2. pip resolves the latest compatible release and its transitive dependencies using the user's configured package index.
3. A compromised upstream release, compromised mirror, or future vulnerable dependency version is selected without review.
4. Package installation code executes with the privileges of the user running pip.
5. The installed package is subsequently imported by the claimed Excel tooling, allowing compromised dependency ...[truncated 538 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin openpyxl to a reviewed version instead of resolving an unrestricted latest release.
2. Provide a dependency lockfile generated from an audited environment.
3. Require artifact hashes, for example through a requirements file used with pip's --require-hashes option.
4. Explicitly use the official Python Package Index over HTTPS and warn users against untrusted mirrors.
5. Install dependencies inside a dedicated virtual environment with no unnecessary system privileges.
6. Add automated vulnerability and license scanning for direct and transitive dependencies.
7. Establish a controlled update process so pinned versions are reviewed, tested, and deliberately advanced.
8. Update every duplicated installation command in both copies of SKILL.md.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation states that uploaded Excel files are automatically synced to Google Drive, but it does not present this as an explicit opt-in data transfer or warn about privacy implications. If used with financial, personal, or regulated spreadsheet data, this can cause unintended exfiltration to a third-party cloud service and create compliance and confidentiality risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README promotes automatic Google Drive sync and backup of spreadsheet contents but does not warn users that file data may be transmitted to a third-party cloud service. This can lead to unintentional disclosure of sensitive spreadsheet data, especially because Excel files often contain financial, personal, or business information and the examples frame upload/sync as a default benefit.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The invocation guidance is overly broad and encourages automatic use whenever users upload or ask about Excel files, without requiring confirmation for data handling side effects. In this skill, use of the workflow implicitly triggers cloud upload to Google Drive and local SQLite tracking, so underspecified routing can cause unintended disclosure or persistence of sensitive spreadsheet contents.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill explicitly maintains session-like state via SQLite tracking of files, formulas, paths, and metadata across operations, but the user-facing guidance does not clearly frame this persistence or its privacy implications. In a multi-file, multi-user assistant context, retained state can lead to accidental cross-session data exposure, stale file selection, or unauthorized reuse of previously uploaded spreadsheet metadata.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

- ✅ **SQLite Tracking** — Track all files, formulas, and metadata in local database
- ✅ **Multi-file Support** — Work with multiple Excel files simultaneously
- ✅ **Data Analysis** — Query data, read formulas, and analyze structure
- ✅ **Mass Operations** — Create formulas for entire columns at once

## Quick Start

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The quick-start flow tells users to upload an .xlsx file and says the workflow automatically uploads it to Google Drive and stores metadata in SQLite, but it does not present this as a clear privacy warning or require explicit consent. Because spreadsheets often contain confidential business or personal data, silent cloud sync and local retention materially increase the risk of unauthorized disclosure and unexpected data persistence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README advertises automatic Google Drive sync and backup for uploaded Excel files but does not warn users that file contents may be transmitted to an external third-party service. Because spreadsheets often contain sensitive business or personal data, this omission can lead to unintentional data exfiltration and privacy/compliance issues when users believe processing is local-only.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill description is broad enough to activate on many ordinary Excel-related requests, including ambiguous cases where the user may only want local analysis or simple tabular help. Because this skill performs file processing, local tracking, and cloud sync, over-invocation can cause unintended handling of sensitive spreadsheets and trigger side effects the user did not clearly request.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill persistently stores file metadata and formulas in a local SQLite database and supports multi-file workflows, but the documentation does not define retention limits, access controls, or user consent around this persistence. Spreadsheet metadata and formulas can reveal sensitive business logic, identifiers, and financial structure, so silent retention increases exposure beyond the immediate task.

Content

Scanner excerpt · excel-workflow-skill-package/SKILL.md (reported line 32)May include surrounding context.

md

- ✅ **SQLite Tracking** — Track all files, formulas, and metadata in local database
- ✅ **Multi-file Support** — Work with multiple Excel files simultaneously
- ✅ **Data Analysis** — Query data, read formulas, and analyze structure
- ✅ **Mass Operations** — Create formulas for entire columns at once

## Quick Start

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example response presents totals using the Russian ruble symbol and Russian locale formatting even though the user did not request that language or locale. This can violate language/locale policy by implicitly forcing a specific locale instead of matching the user's preferences.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This response example again outputs a value with the Russian ruble symbol despite no user opt-in to that locale. Repeated locale-specific examples can encourage agents to default to that language/currency formatting inappropriately.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 472)May include surrounding context.

bash

# Install rclone
brew install rclone  # macOS
sudo apt install rclone  # Linux

Issue: "openpyxl not installed"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · excel-workflow-skill-package/SKILL.md (reported line 472)May include surrounding context.

bash

# Install rclone
brew install rclone  # macOS
sudo apt install rclone  # Linux

Issue: "openpyxl not installed"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The example responses use the ruble symbol and Russian-style output formatting, which implies a fixed locale in the skill's natural-language behavior. The README does not state that locale is user-selectable or that the skill is intended only for a Russian-specific context, so this may violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The sample response presents values in "руб" and therefore implies a specific locale/currency in agent output. Because the documentation does not say this is a region-specific skill or that the user selected that locale, this is a natural-language locale policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The confirmation example reports revenue as "1,000,000 руб," again forcing a specific locale/currency choice in agent language. This can violate language/locale policy when the user has not requested that locale and the skill is not documented as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The example responses format revenue using the Russian ruble symbol and Russian-style locale context, but the README does not say the skill is region-specific or allow users to choose locale/currency. This can indicate a natural-language locale policy issue because the skill appears to impose a specific locale by default.

Content

No source excerpt is available for this finding.