Back to skill

Security audit

Excel2Insights Pro

Security checks across malware telemetry and agentic risk

Overview

This skill locally analyzes user-selected spreadsheet files and produces summaries, charts, and reports, with no evidence of hidden network access, credential use, persistence, or destructive behavior.

Install only if you are comfortable with the agent reading the spreadsheet contents you point it at, including row previews and categorical values in reports. Avoid running it on highly sensitive files unless you control where outputs and logs are stored. Maintainers should pin dependencies and sanitize generated filenames, but the reviewed artifact is coherent and local-only.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The walkthrough includes very broad natural-language trigger examples such as asking to analyze sales data, inspect CSV columns, generate charts, or produce a full report. In an agent skill context, these generic phrases can cause the skill to activate unintentionally for ordinary user requests, increasing the chance of unexpected file processing or tool execution beyond what the user specifically intended.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script includes raw file contents from the first and last rows in its JSON output, which can expose sensitive data from user-supplied spreadsheets or CSVs to logs, calling systems, or downstream consumers. In a file-reader skill, this is especially risky because users may process confidential business or personal data and may not realize that stdout output contains sample records.

Unpinned Dependencies

Low
Category
Supply Chain
Content
pandas>=2.0.0
numpy>=1.24.0
openpyxl>=3.1.0
matplotlib>=3.7.0
Confidence
98% confidence
Finding
pandas>=2.0.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
pandas>=2.0.0
numpy>=1.24.0
openpyxl>=3.1.0
matplotlib>=3.7.0
seaborn>=0.12.0
Confidence
98% confidence
Finding
numpy>=1.24.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
pandas>=2.0.0
numpy>=1.24.0
openpyxl>=3.1.0
matplotlib>=3.7.0
seaborn>=0.12.0
tabulate>=0.9.0
Confidence
98% confidence
Finding
openpyxl>=3.1.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
pandas>=2.0.0
numpy>=1.24.0
openpyxl>=3.1.0
matplotlib>=3.7.0
seaborn>=0.12.0
tabulate>=0.9.0
Confidence
98% confidence
Finding
matplotlib>=3.7.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy>=1.24.0
openpyxl>=3.1.0
matplotlib>=3.7.0
seaborn>=0.12.0
tabulate>=0.9.0
Confidence
98% confidence
Finding
seaborn>=0.12.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
openpyxl>=3.1.0
matplotlib>=3.7.0
seaborn>=0.12.0
tabulate>=0.9.0
Confidence
98% confidence
Finding
tabulate>=0.9.0

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.