ClawHub
Back to skill

Security audit

excel-format-optimizer

Security checks for vulnerabilities and agentic risk

Overview

This Excel formatting skill is coherent and purpose-aligned, but users should be aware it edits workbook formatting and suggests an unpinned package install from a third-party mirror.

Install only if you want an agent to read an Excel workbook and create a reformatted copy. For sensitive spreadsheets, confirm the output filename before saving and avoid running the provided pip install as written unless you trust the mirror; prefer a pinned openpyxl version in a dedicated virtual environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:24
Finding

Unpinned Dependency Installation from a Third-Party Package Mirror

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24-26
Vulnerability Type: Supply-chain exposure through an unpinned dependency and unsafe package source
Risk Level: Medium

bash
# 国内环境 pypi.org 经常超时，直接用清华镜像
cd "C:\Users\17551\.workbuddy\binaries\python\envs\default"
./Scripts/pip.exe install openpyxl -i https://pypi.tuna.tsinghua.edu.cn/simple --timeout 30

Technical Analysis

The Skill directs the agent to install openpyxl without pinning a reviewed version or verifying the downloaded artifact with a cryptographic hash. It also explicitly overrides the package index with a third-party mirror.

Consequently, package selection and content may change after the Skill has been audited. The installed artifact depends on whatever compatible release and files the configured mirror serves at execution time. Compromise of the mirror, its synchronization process, the upstream package, or package-maintainer credentials could therefore introduce attacker-controlled package content. Python package installation may execute build-system or installation-related code, depending on the distributed artifact and the behavior of the package-management tool.

The hard-coded, user-specific managed-environment path is also non-portable and may cause unintended environment modification, but it is not independently treated as a security vulnerability in this report.

Attack Path

  1. An attacker compromises the configured mirror, its package synchronization channel, an upstream release, or relevant publisher credentials.
  2. The attacker causes a malicious or altered openpyxl distribution to be offered by the configured package index.
  3. The agent follows the documented pip install instruction.
  4. Because no version or artifact hash is enforced, pip accepts the package selected from the mirror.
  5. Malicious installation or imported package code executes under the account running the managed Python environment. ...[truncated 625 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin openpyxl to a reviewed, known-good version rather than resolving the latest available release.
  2. Store dependencies in a version-controlled lock file or requirements file with cryptographic hashes.
  3. Install with hash enforcement, for example:
    bash
    pip install --require-hashes -r requirements.txt
  4. Prefer the canonical PyPI index over an explicitly configured third-party mirror. If organizational policy requires a mirror, use a controlled internal repository that validates upstream signatures or hashes and retains approved artifacts.
  5. Configure pip to accept binary wheels only where feasible, reducing exposure to source-build execution:
    bash
    pip install --only-binary=:all: --require-hashes -r requirements.txt
  6. Perform installation in a dedicated, least-privilege virtual environment rather than relying on a hard-coded user-specific path.
  7. Separate dependency provisioning from normal Skill execution and require dependencies to be reviewed and installed by a trusted deployment process.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger language is broad enough to match many generic Excel complaints, increasing the chance the skill activates on loosely related requests and modifies files when the user did not clearly request formatting changes. In a file-modifying skill, overbroad triggering is dangerous because it can cause unintended write operations on user documents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill description does not prominently warn that it will modify and save user Excel files, despite later workflow steps performing bulk formatting changes and writing output. Lack of upfront disclosure undermines informed consent and can lead to accidental alteration of important spreadsheets, especially where formulas, merged cells, and visual conventions matter.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

该技能声明自己是面向 Windows 桌面端的 Excel 格式优化工具，核心职责是读取并修改本地工作簿格式。SKILL.md 却明确要求使用 pip 连接清华镜像安装 openpyxl，这属于额外的网络访问能力，且并非执行格式优化本身的直接组成部分。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The instructions prescribe 微软雅黑 for Windows and PingFang SC for Mac as the unified fonts. This hard-coded locale-specific choice may impose a particular language/script presentation without giving the user a preference option or documenting that the skill is intended only for Chinese-language spreadsheets.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.