Casely

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:41 AM UTC
• Version: 0.1.0

Overview

Casely is a coherent QA document-to-test-case workflow, but its setup and Excel export have concrete safety issues users should review before installing.

Install only if you are comfortable with the skill creating project files, reading requirement/example documents, and modifying the repository Python environment during setup. Review or pin the dependencies before running /init, and treat exported XLSX files as untrusted unless formula injection is fixed by escaping values that begin with formula-triggering characters.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:64
• Finding: Unpinned Third-Party Dependencies Installed During Project Initialization<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 64–68 **Vulnerability Type**: Uncontrolled third-party dependency resolution **Risk Level**: Medium ### Vulnerable Code ```markdown 2. **Environment Setup via `uv`:** - **Location:** Dependencies are defined in `pyproject.toml` at the **repository root** (not inside the skill folder). Scripts expect `uv sync` to have been run from that root. - Check if `pyproject.toml` exists at the repo root. If not, run `uv init` there. - Install/verify dependencies: `uv add docling openpyxl` (or `uv sync` from repo root). - This ensures a lightning-fast setup and handles all sub-dependencies (e.g. `torch` for `docling`) automatically. ``` ### Technical Analysis The initialization instructions direct the agent to install `docling` and `openpyxl` without specifying reviewed versions, hashes, or a mandatory lockfile. Running `uv add` resolves the current versions of these packages and their transitive dependencies from the configured package index. Consequently, the code installed during initialization can differ from the code originally reviewed. The risk includes upstream package compromise, malicious transitive dependencies, dependency confusion caused by an untrusted package index, and unexpected security regressions in later releases. The fallback instruction to run `uv init` may also create or alter dependency configuration in the repository before dependencies are resolved. This is a supply-chain weakness rather than evidence that either named package is currently malicious. ### Attack Path 1. A user invokes the skill's `/init` workflow. 2. The agent follows `SKILL.md` and runs `uv init` where needed. 3. The agent runs `uv add docling openpyxl`, or runs an unlocked synchronization against mutable dependency constraints. 4. The package manager contacts its configured package index and resolves current package and transitive-dependency versions. 5. If the index, an upstream release, ...[truncated 716 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Define dependencies in a committed and reviewed `pyproject.toml`. 2. Pin direct dependencies to approved versions and review relevant transitive dependencies. 3. Commit a generated `uv.lock` file and use a locked installation command such as: ```bash uv sync --locked ``` 4. Do not run `uv init` or `uv add` as part of the normal skill workflow. 5. Fail initialization if the approved manifest or lockfile is absent rather than dynamically creating dependency configuration. 6. Configure an explicit trusted package index and prevent fallback to unapproved indexes. 7. Where supported, verify package artifacts using hashes or signed provenance. 8. Run dependency installation and document conversion in an isolated environment with minimal filesystem and network permissions. 9. Add automated dependency vulnerability and provenance scanning to the release process. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/export_to_xlsx.py:89
• Finding: Spreadsheet Formula Injection Through Untrusted Markdown Cell Values<![CDATA[ ## Vulnerability Details **File Location**: `scripts/export_to_xlsx.py`, lines 89–111 **Vulnerability Type**: XLSX formula injection **Risk Level**: High ### Vulnerable Code ```python for md_file in md_files: headers, rows = parse_md_table(md_file.read_text(encoding='utf-8')) if not headers: print(f"Skipping {md_file.name}: No table found.") continue # Create a new workbook for each file wb = Workbook() ws_opt = wb.active if ws_opt is None: print(f"Skipping {md_file.name}: Failed to create worksheet.") continue ws: Worksheet = ws_opt # type: ignore[assignment] ws.title = "Test Case" # Write headers for col_idx, header in enumerate(headers, 1): ws.cell(row=1, column=col_idx, value=header) # Write data rows for row_idx, row in enumerate(rows, 2): for col_idx, value in enumerate(row, 1): clean_value = value.replace('<br>', '\n').replace('<BR>', '\n') if value else '' cell = ws.cell(row=row_idx, column=col_idx, value=clean_value) ``` ### Technical Analysis The exporter reads Markdown table content and writes both headers and data values directly into XLSX cells. It only replaces HTML line-break markers and does not neutralize values that spreadsheet applications can interpret as formulas. In particular, `openpyxl` treats a string beginning with `=` as a formula when assigning it as a cell value. Spreadsheet applications may also treat values beginning with `+`, `-`, or `@` as formula-like content depending on the application and import behavior. An attacker who can influence a requirement document, generated test case, or Markdown file in `results/` can place a formula payload in a table cell. The payload is preserved in the exported workbook and may be evaluated when a user opens it. The exact effects depend on the spreadsheet application, platform, security configuration, and whether external links or legacy formula features ...[truncated 1853 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat every value derived from Markdown or generated content as untrusted text. 2. Before writing headers or data cells, neutralize values beginning with spreadsheet formula-triggering characters: `=`, `+`, `-`, and `@`. 3. A suitable defensive helper is: ```python def sanitize_excel_text(value: str) -> str: if value and value[0] in ("=", "+", "-", "@"): return "'" + value return value ``` 4. Apply the sanitizer to both headers and data values: ```python safe_header = sanitize_excel_text(header) ws.cell(row=1, column=col_idx, value=safe_header) clean_value = value.replace("<br>", "\n").replace("<BR>", "\n") if value else "" safe_value = sanitize_excel_text(clean_value) cell = ws.cell(row=row_idx, column=col_idx, value=safe_value) ``` 5. Explicitly store untrusted cells as strings where practical, and verify the resulting XLSX cell data types after saving and reopening the workbook. 6. Do not rely solely on blocking `=`; account for all formula-triggering prefixes and leading whitespace or control characters that spreadsheet applications may ignore. 7. Add regression tests using values such as: ```text =1+1 +SUM(1,1) -1+2 @SUM(1,1) =HYPERLINK("https://example.invalid","test") ``` 8. Document that exported workbooks contain untrusted project data and should be opened with external links, macros, and legacy formula execution disabled. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared behavior presents the skill as a full QA workflow assistant, but the detected implementation appears to provide only document parsing/conversion and additional undeclared format handling. Description-to-behavior mismatch is dangerous because users and orchestrators may grant trust or invoke the skill under false assumptions, leading to unexpected file processing, broader document ingestion, or missed review of undeclared capabilities.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs file reads and writes across a project workspace but does not declare any explicit tool scope or permissions boundaries. This creates an authorization ambiguity where an agent may perform filesystem actions without a clearly constrained contract, increasing the chance of overbroad access or unsafe execution.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The activation description is broad enough to match many ordinary requests involving testing, requirements, PDFs, DOCX, XLSX, or exports. Overbroad triggering can cause the wrong skill to activate and begin suggesting or performing filesystem and document-processing actions in contexts where the user did not intend that level of access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The `/init` workflow instructs creation of directories, dependency installation, and environment modification via `uv` without an explicit warning or consent checkpoint. This is risky because it can change the local filesystem and Python environment, potentially installing packages or initializing project files unexpectedly.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The parsing workflow directs processing of requirement and example documents without a privacy or data-handling warning. Requirement documents often contain sensitive business logic, credentials, customer data, or proprietary content, so ingesting them without notice increases the risk of unintended exposure or mishandling.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The skill states that future test cases will be generated in the detected project language by default, without indicating an explicit user confirmation step. This can cause unintended language lock-in, especially when source examples are multilingual, attacker-supplied, or contain a misleading dominant language, leading to outputs that are inaccessible to the user or unsuitable for downstream QA workflows.

Vague Triggers

Low

• Confidence: 84% confidence
• Finding: This JSON eval file is a manifest-type file, so vague trigger review applies. The phrase "Everything looks good. Export the generated test cases to a formatted Excel file for my TMS." mixes a generic conversational lead-in with the requested action, and it does not define any narrower activation constraints or exclusions, which could make invocation boundaries less specific.

Static analysis

No suspicious patterns detected.