officecli-data-dashboard

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:58 AM UTC
• Version: 1.0.3

Overview

The skill is coherent for building Excel dashboards, but its setup tells users to execute remote installer scripts directly, which is too high-impact without verification.

Install only if you trust the officecli distribution path. Prefer downloading a pinned release from the official release channel and verifying its checksum or signature before running it, instead of piping the installer directly into a shell. The workbook-editing instructions themselves are purpose-aligned, but raw XML steps should be applied only to files you intend to modify.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14

Finding

Unverified Remote Installer Download and Immediate Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–15
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash

- **macOS / Linux**: `curl -fsSL https://d.officecli.ai/install.sh | bash`
- **Windows (PowerShell)**: `irm https://d.officecli.ai/install.ps1 | iex`

Technical Analysis

Both installation commands retrieve mutable scripts from d.officecli.ai and immediately pass their contents to a command interpreter. The macOS/Linux command pipes the response into Bash, while the Windows command passes it to PowerShell's Invoke-Expression.

The downloaded payload is not pinned to a specific version, displayed for review, authenticated with a publisher signature, or checked against a trusted cryptographic hash. Consequently, the code ultimately executed can differ from the content available when the Skill was audited.

Installing officecli may be necessary for the declared spreadsheet-dashboard functionality, but executing mutable network content directly is not the minimum capability required. The document already identifies downloadable GitHub release artifacts as an alternative, although it does not provide integrity-verification instructions for those artifacts either.

Attack Path

1. A user or agent follows the setup instructions because officecli is unavailable.
2. The shell requests an installation script from d.officecli.ai.
3. The remote host, its deployment pipeline, DNS resolution, or another delivery-chain component is compromised or serves a maliciously modified script.
4. The response is sent directly to Bash or PowerShell without prior inspection or integrity verification.
5. The interpreter executes the attacker-controlled payload with the privileges of the user running the command.
6. The payload can then perform any action available to that user, including modifying files, accessing readable data, invoking network services, or installing additional co ...[truncated 855 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both direct pipe-to-interpreter installation commands.
2. Pin installation instructions to a specific, immutable release version.
3. Prefer artifacts from the stated official GitHub release repository rather than a mutable installer endpoint.
4. Publish trusted SHA-256 checksums through a separately controlled channel and require verification before execution.
5. Provide cryptographic signatures and document verification against a pinned publisher key.
6. Download the artifact to disk first so its origin, signature, hash, and contents can be inspected before installation.
7. Require explicit user confirmation before executing any installer.
8. Avoid administrative privileges unless a specific installation step requires them, and clearly document why each elevated operation is necessary.
9. For macOS/Linux, use a flow equivalent to:

bash

VERSION="<pinned-version>"
curl -fL -o officecli.tar.gz \
  "https://github.com/iOfficeAI/OfficeCLI/releases/download/${VERSION}/<pinned-artifact>"
printf '%s  %s\n' "<trusted-sha256>" "officecli.tar.gz" | sha256sum -c -
# Verify the publisher signature as well, then inspect and install the artifact.

10. For Windows, use Invoke-WebRequest only to download a pinned artifact, verify its Authenticode signature and published hash, and then invoke it explicitly rather than using Invoke-Expression.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

curl -fsSL https://d.officecli.ai/install.sh | bash is a classic remote code execution pattern because it combines retrieval and execution in one step with no integrity verification. In a skill intended for general users building spreadsheets, this is especially dangerous because it normalizes executing opaque installer code from the network.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

If `officecli` is missing:

- **macOS / Linux**: `curl -fsSL https://d.officecli.ai/install.sh | bash`
- **Windows (PowerShell)**: `irm https://d.officecli.ai/install.ps1 | iex`

Verify with `officecli --version` (open a new terminal if PATH hasn't picked up). If install fails, download a binary from https://github.com/iOfficeAI/OfficeCLI/releases.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs users to pipe remotely fetched scripts directly into bash and PowerShell (iex), which executes unreviewed network content immediately. If the download host, transport, DNS, or upstream distribution is compromised, this becomes arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Requirements section instructs users to confirm the sheet index before filling activeTab="N", implying a normal property-setting flow, while the Quick Start later implements activeTab by inserting raw XML under /workbook. This is an active contradiction in intent/documentation because the file teaches one approach but demonstrates another lower-level mutation path.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.