ClawHub
Back to skill

Security audit

Spreadsheet

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent spreadsheet helper skill, with expected but sensitive Google Sheets credential and write examples that users should scope carefully.

Before installing, ensure any Google service account has access only to intended spreadsheets, confirm write and append ranges before use, and avoid storing actual secrets in ~/spreadsheet memory files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md
## Common Traps

- **Truncating without warning** - Always confirm before loading >1000 rows
- **Losing formulas** - Use `data_only=False` in openpyxl, read formulas separately
- **Schema drift** - Re-verify if last access >7 days
- **Rate limits** - Batch Google Sheets requests, max 100/100s

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · google-sheets.md (reported line 11)May include surrounding context.

md
from googleapiclient.discovery import build

creds = Credentials.from_service_account_file(
    'credentials.json',
    scopes=['https://www.googleapis.com/auth/spreadsheets']
)
service = build('sheets', 'v4', credentials=creds)

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The service_account: ~/credentials.json entry points at a likely sensitive credential file, which is especially risky in an agent skill because skills often read local files as part of task execution. Even without embedded secrets, normalizing credential-path access can enable unauthorized credential harvesting, misuse of Google Sheets APIs, or broader compromise if the same file is reused elsewhere.

Content

Scanner excerpt · memory-template.md (reported line 49)May include surrounding context.

md
| Category | C | enum |

## API Config
service_account: ~/credentials.json

---
*Last sync: YYYY-MM-DD*

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This is a markdown file, so SQP-2 applies to omissions in the skill description. The examples show remote spreadsheet modification via update and append calls, but the document does not warn that these actions will change user data in Google Sheets and may overwrite or add records.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The template explicitly directs users to store a service account credential path in project memory without any warning or guardrails for secret handling. In an agent context, referencing ~/credentials.json can normalize access to sensitive local credential material and may encourage downstream components to read or expose that file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The 'TRAP' note and the following bullet state that using data_only=True loses or destroys formulas forever. In openpyxl, data_only=True affects what values are returned when reading cells; it does not itself modify the workbook or erase formulas unless a workbook is later rewritten in a particular way. This is an active contradiction in the documentation rather than a mere omission.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The template sets number_locale: en-US as a default locale in natural language/config-like content. This may violate language/locale policy because it forces a specific locale without offering opt-in, alternatives, or documenting why this locale is required.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The skill is described as working with tabular data and schema memory, which can justify spreadsheet identifiers and format metadata, but this template also bakes in a specific remote SaaS URL and a local service account credential path. Embedding credential-location guidance is a capability adjacent to external service authentication rather than a necessary part of a generic spreadsheet memory template.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.