Excel Builder

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:42 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Excel file builder, with minor caution needed around broad triggers and unpinned package installation instructions.

Before installing, confirm you want the agent to create or modify Excel files. If dependencies are missing, prefer installing pinned versions in a dedicated virtual environment rather than letting an agent run unpinned pip installs in a shared environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:69

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 69–70
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

text

- If `openpyxl` not installed: `pip install openpyxl`
- If `xlsxwriter` not installed: `pip install xlsxwriter`

Technical Analysis

The Skill instructs the agent to install third-party Python packages without exact version constraints, integrity hashes, an explicitly approved package index, or user confirmation. Consequently, package contents and transitive dependencies can vary between executions.

Python package installation can execute package build and installation logic. If a package source, release, dependency, or configured package index is compromised or substituted, attacker-controlled code could execute during installation. The absence of a lock file and hash verification prevents the installer from confirming that the resolved artifacts are the versions reviewed and approved by the project.

Attack Path

1. A user invokes the Excel Builder Skill in an environment where openpyxl or xlsxwriter is unavailable.
2. The agent follows the documented error-handling instruction and executes the corresponding unpinned pip install command.
3. pip resolves the current package release and its transitive dependencies through the environment's configured package index.
4. A compromised index, package release, or transitive dependency supplies malicious installation or runtime code.
5. The malicious code executes with the privileges of the account running pip and may subsequently run again when the installed library is imported.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the privileges of the agent or user performing the installation. The affected scope may include files, environment variables, credentials, network resources, and services accessible to that account. If installation is perfo ...[truncated 184 chars]

Remediation

View remediation

Remediation Suggestions

• Remove automatic or implicit dependency installation instructions from the Skill workflow.
• Require explicit user approval before installing any package.
• Define reviewed dependencies in a lock file or requirements file using exact versions.
• Record and enforce cryptographic hashes for all direct and transitive dependency artifacts.
• Install with a command such as python -m pip install --require-hashes -r requirements.txt.
• Configure an approved package index and disable unintended fallback indexes.
• Perform installation inside a dedicated, least-privileged virtual environment or isolated container.
• Periodically scan and update locked dependencies through a controlled review process.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list is very broad and includes generic terms such as "Excel", "spreadsheet", "formula", and library names like "openpyxl" and "xlsxwriter", which can cause the skill to activate for many loosely related requests. Over-broad invocation increases the chance of unintended tool use, incorrect routing, or an attacker steering execution toward file-generation behavior when the user did not explicitly request it.

Content

No source excerpt is available for this finding.