T09 · Insecure Skill Coding Practices
- Location
scripts/build_xlsx.py:83- Finding
Untrusted Tavily Results Can Cause Spreadsheet Formula Injection
- Content
View full analysis
Vulnerability Details
File Location:
scripts/build_xlsx.py:83-91, 333-347
Vulnerability Type: Spreadsheet formula injection
Risk Level: MediumComplete Code Snippet
python def fill_row(ws, row: int, values: list, fill: PatternFill, height: int = None) -> None: for j, v in enumerate(values, start=1): cell = ws.cell(row=row, column=j, value=v) cell.alignment = WRAP cell.border = BORDER cell.fill = fill if height: ws.row_dimensions[row].height = heightThe vulnerable helper is used to write Tavily source metadata directly into workbook cells:
python fuentes = data.get("fuentes_tavily") or [] if fuentes: ws7 = wb.create_sheet("Fuentes Tavily") style_title(ws7, 1, 2, "FUENTES CONSULTADAS (TAVILY)") for j, h in enumerate(["Título", "URL"]): ws7.cell(row=2, column=j + 1, value=h) style_header(ws7, 2, 2) for i, f in enumerate(fuentes): fill = ALT_FILL if i % 2 == 0 else WHITE_FILL fill_row(ws7, 3 + i, [f.get("titulo", ""), f.get("url", "")], fill, 28) autosize(ws7, [50, 80]) ws7.freeze_panes = "A3" out_path.parent.mkdir(parents=True, exist_ok=True) wb.save(out_path)Technical Analysis
SKILL.md:215-248directs the agent to perform Tavily web searches and retain consulted source titles and URLs. Those values originate from independently controlled web pages and therefore cross an external-content trust boundary.build_xlsx.pyreads these values fromfuentes_tavilyand passes them unchanged toopenpyxlthroughWorksheet.cell(..., value=v). Values beginning with spreadsheet formula prefixes—most importantly=—are not neutralized or forced to the string data type. Consequently, a malicious page title such as a formula expression can be stored as an active formula rather than displayed as literal text.The generic
fill_rowfunction also writes othe ...[truncated 1955 chars]- Remediation
View remediation
Remediation Suggestions
Treat every value obtained from Tavily or other external content as untrusted before writing it to a workbook.
-
Introduce a centralized literal-cell sanitizer and apply it in
fill_row:python FORMULA_PREFIXES = ("=", "+", "-", "@") def spreadsheet_literal(value): if isinstance(value, str) and value.startswith(FORMULA_PREFIXES): return "'" + value return value def fill_row(ws, row: int, values: list, fill: PatternFill, height: int = None) -> None: for j, value in enumerate(values, start=1): cell = ws.cell( row=row, column=j, value=spreadsheet_literal(value), ) cell.alignment = WRAP cell.border = BORDER cell.fill = fill if height: ws.row_dimensions[row].height = height -
Apply the same protection to every direct cell assignment containing brief, generated, or Tavily-derived data—not only to the source-title column.
-
Alternatively, explicitly force untrusted cells to the string data type after assignment, while verifying through tests that
openpyxlserializes them as literal strings. -
Add regression tests covering values beginning with
=,+,-, and@, including formulas that reference external resources. -
Keep legitimate hyperlinks separate from displayed text. Validate URL schemes against a narrow allowlist such as
httpsbefore assigning hyperlink targets.
-