T09 · Insecure Skill Coding Practices
Error
- Location
scripts/export_xlsx.js:181- Finding
Spreadsheet Formula Injection in Exported Workbooks
- Content
View full analysis
[ q.date ?? '', q.module ?? '', q.subtype ?? '', q.error_reason ?? '', q.question_text ?? q.question_desc ?? '', q.visual_description ?? '', q.answer ?? '', q.analysis ?? q.user_annotation ?? '', Array.isArray(q.keywords) ? q.keywords.join('、') : '', q.status ?? '待二刷', q.source_engine ?? (q.source === 'image' ? '图片' : '文字'), '', ]); ``` The generated Python code writes those values directly into spreadsheet cells: ```python for ri, row in enumerate(wrong_rows, 2): for ci, val in enumerate(row, 1): cell = ws.cell(row=ri, column=ci, value=val) cell.alignment = Alignment(vertical="center", wrap_text=(ci in [5, 6, 8])) cell.font = Font(name="Arial", size=9) ``` ### Technical Analysis Spreadsheet applications may interpret text beginning with `=`, `+`, `-`, or `@` as a formula rather than inert text. The exported fields include content derived directly from user messages, screenshots, annotations, and multimodal-model output. No validation or formula neutralization is applied before these values reach `openpyxl`. Consequently, an attacker who can influence a stored question, annotation, analysis, visual description, or daily note can insert a spreadsheet formula into the generated XLSX file. This is especially relevant when study records are populated from untrusted forwarded messages, shared screenshots, imported data, or potentially manipulated model output. ### ...[truncated 1436 chars]- Remediation
View remediation