T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:205- Finding
Excel Formula Injection Through Unsanitized Estimate Fields
- Content
View full analysis
pd.DataFrame: """Export estimate to DataFrame.""" data = [] for item in self.items: data.append({ 'Line': item.line_number, 'WBS': item.wbs_code, 'Description': item.description, 'Qty': item.quantity, 'Unit': item.unit, 'Unit Cost': item.unit_cost, 'Total': item.total_cost, 'Category': item.category.value, 'Notes': item.notes }) return pd.DataFrame(data) def export_to_excel(self, output_path: str) -> str: """Export estimate to Excel.""" totals = self.calculate_total() with pd.ExcelWriter(output_path, engine='openpyxl') as writer: # Cover sheet cover_df = pd.DataFrame([{ 'Project Name': self.project_name, 'Project Number': self.project_number, 'Estimate Date': self.estimate_date, 'Total Items': len(self.items), 'Direct Cost': totals['cost_summary']['direct_cost'], 'Grand Total': totals['grand_total'] }]) cover_df.to_excel(writer, sheet_name='Summary', index=False) # Line items items_df = self.export_to_df() items_df.to_excel(writer, sheet_name='Line Items', index=False) # Cost breakdown breakdown_df = pd.DataFrame([totals['cost_summary']]) breakdown_df.to_excel(writer, sheet_name='Cost Breakdown', index=False) # Markups if totals['markups']: markups_df = pd.DataFrame(totals['markups']) markups_df.to_excel(writer, sheet_name='Markups', index=False) ``` ### Technical Analysis The Excel export path writes user-controlled textual fields directly into an XLSX workbook without neutralizing spreadsheet formulas. Affe ...[truncated 2573 chars]- Remediation
View remediation