officecli-financial-model

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:08 AM UTC
• Version: 1.0.3

Overview

This skill is mostly coherent for building financial models, but its setup instructions tell users to run mutable remote installer scripts directly in a shell without verification.

Install only if you are comfortable with the OfficeCLI dependency and avoid running the pipe-to-shell setup commands as written. Prefer a versioned release from the official repository with checksum or signature verification, and review the base officecli-xlsx skill dependency before use.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:16

Finding

Unverified Remote Installer Piped Directly into System Shells

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–17
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

markdown

- **macOS / Linux**: `curl -fsSL https://d.officecli.ai/install.sh | bash`
- **Windows (PowerShell)**: `irm https://d.officecli.ai/install.ps1 | iex`

Technical Analysis

Both installation commands retrieve mutable content from an external domain and execute it immediately. The Unix command sends the HTTP response directly to bash, while the Windows command passes it to PowerShell's Invoke-Expression (iex).

The instructions provide no version pinning, cryptographic checksum, signature verification, content review step, or immutable release reference. Consequently, the effective code executed during installation may differ from the content available when the Skill was audited. HTTPS protects the connection in transit but does not establish that the server's current payload is trustworthy, immutable, or uncompromised.

This behavior is unnecessary for the Skill's core purpose of guiding financial-model creation. Installing a required CLI may be legitimate, but arbitrary remote code execution is not the minimum privilege or safest installation method needed to obtain that dependency.

Attack Path

1. A user or Agent loads the Skill and determines that officecli is unavailable.
2. It follows the setup instructions for the operating system.
3. The command retrieves a script from d.officecli.ai.
4. If the hosting account, web server, DNS path, deployment pipeline, or script itself is compromised, an attacker substitutes malicious shell commands.
5. bash or iex executes the response immediately under the invoking user's account without integrity verification or review.
6. The payload can then access resources available to that account or download and execute further components.

Impact Assessment

The remote payload obtains arbitrary code execution wi ...[truncated 836 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both direct execution pipelines:

   • Do not use curl ... | bash.
   • Do not use irm ... | iex.

2. Refer users to a specific, versioned release hosted through the project's official release channel rather than a mutable installer endpoint.

3. Publish cryptographic checksums and preferably signed release artifacts. Require verification before execution. For example:

   • Download the artifact as a separate step.
   • Verify its SHA-256 digest against a pinned value delivered through a trusted channel.
   • Verify a code-signing or detached signature where supported.
   • Execute or install it only after successful verification.

4. Pin the documented dependency version so future changes cannot silently alter the audited installation payload.

5. Prefer a trusted package manager with version locking and package-signature verification where available.

6. If an installer script remains necessary, save it locally and instruct the user to inspect it before execution. Document the files, network access, PATH changes, and privileges it requires.

7. State explicitly that installation must run without administrator or root privileges unless a narrowly defined operation genuinely requires elevation. Fail safely rather than requesting broad privilege.

8. Keep the GitHub release fallback version-specific and add checksum or signature verification; merely changing the download host does not eliminate supply-chain risk.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

curl ... | bash is a classic arbitrary code execution pattern because it fetches code from a remote server and immediately executes it with no validation. In the context of an agent skill, this is especially dangerous because the skill operationalizes the command as a normal setup step, increasing the chance that users or agents run it automatically or without scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

If `officecli` is missing:

- **macOS / Linux**: `curl -fsSL https://d.officecli.ai/install.sh | bash`
- **Windows (PowerShell)**: `irm https://d.officecli.ai/install.ps1 | iex`

Verify with `officecli --version` (open a new terminal if PATH hasn't picked up). If install fails, download a binary from https://github.com/iOfficeAI/OfficeCLI/releases.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

**This skill is a scene layer on top of `officecli-xlsx`.** Every xlsx hard rule — shell quoting, incremental execution, Help-First Rule, visual delivery floor, CFO 4-color code (blue input / black formula / green cross-sheet / yellow-fill assumption), number-format standards (years as text, zero as `-`, `%` one decimal, negatives in parens), assumption-cell discipline, CSV batch import, chart data-feed forms (a/b/c), the 5-gate Delivery cycle, cache-drift guidance, Known Issues (the cross-sheet `!` trap, batch + resident for formulas, renderer caveats) — is **inherited, not re-taught**. This file adds only what a **financial model** requires on top: three-zone architecture, 3 model-type recipes (3-statement / DCF / LBO), sensitivity + scenario protocols, financial-function patterns, circular-reference discipline, and model-specific Delivery Gates 4–6.

When the xlsx base rules cover it, the text here says `→ see xlsx v2 §X`. Read `skills/officecli-xlsx/SKILL.md` first if you have not.

## Setup

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

**This skill is a scene layer on top of `officecli-xlsx`.** Every xlsx hard rule — shell quoting, incremental execution, Help-First Rule, visual delivery floor, CFO 4-color code (blue input / black formula / green cross-sheet / yellow-fill assumption), number-format standards (years as text, zero as `-`, `%` one decimal, negatives in parens), assumption-cell discipline, CSV batch import, chart data-feed forms (a/b/c), the 5-gate Delivery cycle, cache-drift guidance, Known Issues (the cross-sheet `!` trap, batch + resident for formulas, renderer caveats) — is **inherited, not re-taught**. This file adds only what a **financial model** requires on top: three-zone architecture, 3 model-type recipes (3-statement / DCF / LBO), sensitivity + scenario protocols, financial-function patterns, circular-reference discipline, and model-specific Delivery Gates 4–6.

When the xlsx base rules cover it, the text here says `→ see xlsx v2 §X`. Read `skills/officecli-xlsx/SKILL.md` first if you have not.

## Setup

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs users to execute remote install scripts directly from the network using shell/PowerShell piping, without integrity verification, pinning, or trust warnings. Because this is a skill file that users may follow verbatim, a compromised host, MITM, or malicious update could lead to arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.