Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Minimax Xlsx
v1.0.0MiniMax spreadsheet production system. Engage for any task that involves tabular data, numeric analysis, or spreadsheet generation. Supports XLSX/XLSM/CSV th...
⭐ 0· 1.9k·62 current·65 all-time
byKris@krisliu16
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md and support docs describe workbook construction (openpyxl/pandas), formula recalculation (LibreOffice via scripts/recalc.py), and a MiniMaxXlsx CLI for validations/pivots. The code bundle includes recalc.py and documentation but does NOT include the referenced CLI binary (./scripts/MiniMaxXlsx). The skill also assumes the presence of soffice (LibreOffice) on PATH but does not declare this dependency. Requiring a user-wide LibreOffice macro and an unbundled CLI is disproportionate to an instruction-only skill unless the missing binary or an install step is provided.
Instruction Scope
Runtime instructions direct the agent to run local shell tools (python recalc.py and ./scripts/MiniMaxXlsx) and to always run the recalc step after saving files. recalc.py scans every cell in a workbook, and its setup step writes a macro file into the user's LibreOffice profile (~/.config/... or ~/Library/...), which modifies user configuration outside the skill directory. The docs also instruct automatic chart generation and other automated actions that could create deliverables beyond minimal user request unless explicitly constrained. The macro write and broad filesystem access are out-of-band for a simple 'generate spreadsheet' instruction set and should be highlighted to users.
Install Mechanism
There is no install spec (lowest installer risk). However, the skill depends on external binaries not declared or provided: 'soffice' (LibreOffice) and the MiniMaxXlsx CLI at ./scripts/MiniMaxXlsx. The absence of an install step for the CLI and lack of a declared dependency on LibreOffice is an inconsistency to resolve before trusting the skill.
Credentials
The skill requests no environment variables or credentials, which is appropriate. That said, it writes a persistent macro into the user's LibreOffice config directory and invokes system binaries; while not a credential leak, this is a persistent change to user environment and should be considered when granting execution.
Persistence & Privilege
recalc.py's setup_libreoffice_macro will create directories and write Module1.xba into the user's LibreOffice macro folder (home directory). This is persistent and affects the user's LibreOffice environment beyond the skill's folder. The skill does not declare or explain this persistence clearly in the metadata, which increases risk and surprises the user.
What to consider before installing
This skill is largely coherent for building Excel deliverables, but take these precautions before installing or running it:
- Confirm the missing CLI: the documentation repeatedly calls ./scripts/MiniMaxXlsx but that binary is not present in the package. Ask the author to provide the binary or an install step, or supply a trusted alternative. Do not run commands that are referenced but not included without verifying their origin.
- Understand and approve the LibreOffice macro write: recalc.py will create a Basic macro (Module1.xba) in your LibreOffice user profile (~/.config/libreoffice/... or ~/Library/Application Support/LibreOffice/...). This is persistent and could be reused by other documents. If you cannot allow writes to your LibreOffice profile, do not run recalc.py. Consider backing up the LibreOffice user basic/Standard folder before first run.
- Ensure LibreOffice (soffice) is installed and available on PATH; the script assumes it but does not declare the dependency. If soffice is missing, the script may fail or behave unexpectedly.
- Run in an isolated environment first: test on a disposable account, VM, or container to observe behaviour (macro creation, soffice invocation, scanning behavior) before using on production data.
- Review the recalc.py source and the Module1.xba contents yourself (the script includes the macro text). If you accept the macro code, you can reduce risk by running the macro creation step manually and auditing it.
- If you need strong guarantees, ask the publisher for: (a) the MiniMaxXlsx CLI binary or a build/install script; (b) a clear explanation/consent step for macro installation; and (c) a minimal-mode that can recalc without writing persistent macros (e.g., using a temporary LibreOffice profile).Like a lobster shell, security has layers — review code before you run it.
latestvk978mp17naxch6g02p3bbcpesx82fkar
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
