ClawHub
Back to skill

Security audit

excel-split-by-column

Security checks across malware telemetry and agentic risk

Overview

This skill locally splits user-provided Excel files into new spreadsheets, with no evidence of network access, credential use, persistence, or destructive behavior.

Install this if you want a local helper for splitting Excel workbooks. Use it on files you are comfortable processing locally, confirm the intended split column and output mode before running, and note that generated files may contain the same sensitive rows as the source workbook.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The metadata description includes broad activation language such as handling uploaded spreadsheets and requests like splitting by department, city, or category, which can match common user intents beyond a tightly scoped invocation. Over-broad triggers increase the chance of accidental skill activation, causing the agent to run file-processing workflows when the user did not explicitly opt into this specific skill.

Vague Triggers

Medium
Confidence
98% confidence
Finding
Using the standalone trigger word '拆分' is overly vague because it can refer to many unrelated user requests, not specifically splitting an Excel workbook by column. This creates a realistic risk of unintended invocation, which is especially relevant here because the skill performs file operations and may generate derivative files or worksheets automatically.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.