ClawHub
Back to skill

Security audit

Cn Excel Formula

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Chinese Excel formula helper with an optional AI mode, but users should notice that AI mode uses an OpenAI API key and may send their prompt off-device.

Install only if you are comfortable with a Chinese-language Excel helper. The default formula generation is local template matching; using --ai with OPENAI_API_KEY may send your description to OpenAI, so do not include confidential workbook data, employee information, customer data, or sensitive business context. The publisher should remove or pin the unused openpyxl dependency and make the AI data flow clearer.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
SKILL.md:20
Finding

Unpinned and Unused Third-Party Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:20
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Complete Code Snippet:

yaml
install: |
  pip install openpyxl

Technical Analysis

The installation instruction retrieves openpyxl without a version constraint or integrity hash. Consequently, installations are not reproducible, and the package content resolved by pip may change after the Skill has been reviewed.

The audited script does not import or use openpyxl, so this dependency unnecessarily increases the supply-chain attack surface. This finding does not establish that the current openpyxl package is malicious; the weakness is reliance on mutable, unverified dependency resolution.

Attack Path

  1. A user follows the installation instructions.
  2. pip resolves the package version available from the configured package index at installation time.
  3. If the package source, account, index, or resolved future release is compromised, attacker-controlled installation logic could run.
  4. That logic would execute with the privileges of the user running pip.

Impact Assessment

Successful exploitation through a compromised dependency could execute arbitrary code with the installing user's privileges. The resulting scope could include access to that user's files, environment variables, and network permissions. No privilege escalation or active dependency compromise was identified in the audited project itself.

Remediation
View remediation

Remediation Suggestions

  1. Remove openpyxl from the installation instructions because the audited implementation does not use it.
  2. If it becomes necessary, pin it to a reviewed, exact version rather than resolving the latest release.
  3. Store dependencies in a lock or requirements file with approved cryptographic hashes.
  4. Install with hash enforcement, such as pip install --require-hashes -r requirements.txt.
  5. Use a trusted package index and periodically review pinned dependencies for security advisories.
  6. Perform installation in an isolated virtual environment with the minimum required privileges.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The markdown explicitly states '公式解释（中文说明每个参数）', which mandates Chinese output for explanations. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, and no such opt-in or justification appears in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The module description and all user-facing CLI help and output strings are in Chinese, effectively forcing a specific language for interaction. Under the stated policy, language constraints should either offer user choice or be clearly documented and justified as locale-specific.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill is presented as a local Excel formula helper, but the optional AI path transmits user-provided descriptions to an external OpenAI service. That creates an undisclosed data-flow boundary: users may include workbook structure, business terms, employee data, or other sensitive content in prompts, assuming processing is local.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

An Excel formula assistant does not inherently require access to host environment variables to fulfill its core purpose of generating and explaining formulas. Reading OPENAI_API_KEY introduces credential access behavior that is only needed because of the undeclared external AI integration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

When AI mode is enabled, raw user descriptions are sent to an external API without any user-facing warning in the program flow. Because natural-language requests may contain confidential spreadsheet values or business context, this can cause unintended disclosure to a third party.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The tag 'chinese' combined with the Chinese-only description and examples indicates a locale/language restriction. While this may be intended, the file does not explicitly state that the skill is for Chinese-language users only or provide a language choice, so it risks violating the language/locale policy.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest and documentation describe a utility for generating and explaining Excel formulas, but the footer advertises an AI brand-search optimization service and links to an external marketing page. Promotional content is not a direct requirement of a formula assistant and introduces an unrelated capability/context into the skill documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The code reads OPENAI_API_KEY from the environment to authenticate outbound API requests. Access to credentials is safety-relevant under the audit rules, and this file does not include a visible warning, comment, or user-facing disclosure explaining that credential material is being consumed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.