T09 · Insecure Skill Coding Practices
- Location
SKILL.md:23- Finding
Spreadsheet Formula Injection in Generated CSV Output
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 23-36
Vulnerability Type: CSV formula injection
Risk Level: MediumThe following is a faithful English translation of the vulnerable instruction segment:
text ### Step 1: Receive input The user sends WeChat group screenshots and/or text messages. - If there is only text: parse it directly. - If there are screenshots: first read the image content using OCR or visual understanding. ### Step 2: Extract each entry Extract information from every relevant message according to the field definitions. - Populate fields that can be extracted. - Leave unavailable fields empty; do not invent information. - Skip messages unrelated to AI-tool usage. ### Step 3: Output structured data as plain text for pasting into a spreadsheet Output in CSV format, without a header, with one record per line. Users can copy and paste it directly into Excel or Teams.Technical Analysis
The Skill accepts untrusted text or OCR content from group-chat messages and places extracted values into CSV cells intended for direct use in Excel or Teams. Its CSV handling only addresses commas by requiring affected fields to be enclosed in quotation marks. It does not require neutralization of cells whose first significant character is
=,+,-, or@.Quoting a cell according to ordinary CSV rules does not prevent spreadsheet formula interpretation. For example, a quoted cell such as
"=WEBSERVICE(...)"can still be interpreted as a formula after import. Leading whitespace, tab characters, carriage returns, and other control characters may also be used to bypass simplistic first-character checks.Because the unsafe behavior is caused by a missing output-sanitization requirement rather than executable source code, the vulnerable segment is the workflow that transfers untrusted input into spreadsheet-ready CSV.
Attack Path
- An attacker posts a group-chat mess ...[truncated 1779 chars]
- Remediation
View remediation
Remediation Suggestions
- Treat every extracted field as untrusted before generating CSV.
- After removing or accounting for leading whitespace and control characters, detect cells beginning with
=,+,-, or@. - Neutralize dangerous cells by prefixing them with a single quotation mark or another spreadsheet-safe text marker appropriate to the target application.
- Do not rely on CSV quotation marks alone; quoting protects CSV structure but does not disable formula evaluation.
- Escape embedded quotation marks according to CSV rules and consistently quote all fields.
- Apply strict validation where feasible. For example, names and AI-tool identifiers should use narrowly defined character sets, while free-text fields should still receive formula neutralization.
- Detect bypass forms involving leading tabs, carriage returns, line feeds, Unicode whitespace, or other control characters.
- Add an explicit warning instructing users to import all columns as text and to review suspicious cells before opening or pasting the output.
- Add tests covering direct formula prefixes, quoted formulas, leading-whitespace bypasses, embedded commas, quotation marks, and multiline values.