table-structure-handler

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:29 PM UTC
• Version:
  1.5.0

Overview

This skill appears to be a straightforward Excel table-formatting helper that reads user-provided workbooks and writes processed copies without hidden network, credential, persistence, or destructive behavior.

Install only if you want an agent to process uploaded Excel files in the workspace. Use simple .xlsx filenames and review processed outputs before relying on them; the skill should not need credentials or network access.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill clearly describes reading Excel files from `/workspace/user_input_files/` and writing processed output to `/workspace/skills_output/`, which means it relies on file read/write capability while declaring no permissions. Even if the intended behavior is legitimate, undeclared capabilities weaken sandboxing and user transparency, and can become dangerous if file selection or path handling is broader than described.

VirusTotal

67/67 vendors flagged this skill as clean.