GI Excel PDF Process

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:32 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Excel/PDF file-processing helper with minor documentation and dependency hygiene issues, but no hidden, persistent, deceptive, or unrelated behavior was found.

Install this only in an environment appropriate for parsing untrusted documents, and prefer pinned or locked dependency versions. Review the broad trigger wording and Chinese-only help text if you need predictable routing or English-facing usage, but the inspected behavior fits normal Excel/PDF processing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded Third-Party Dependency Versions

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-3
Additional Locations: SKILL.md:54, SKILL.md:82
Vulnerability Type: Unrestricted dependency resolution without version locking or integrity verification
Risk Level: Low

Vulnerable Code

text

pandas>=2.0.0
openpyxl>=3.0.0
pdfplumber>=0.10.0

The installation instructions in SKILL.md also install dependencies without version or integrity controls:

bash

pip install pandas openpyxl

bash

pip install pdfplumber

Technical Analysis

Each dependency has only a minimum version constraint and no upper bound, exact pin, lockfile, or cryptographic hash. Consequently, package installation may resolve to any future version published under these package names.

The listed packages are recognizable PyPI projects; no evidence of typosquatting, dependency confusion, or an actively malicious release was identified. The risk is nevertheless present at the supply-chain boundary because the installed code can differ from the versions covered by this audit. If a package publisher account, distribution infrastructure, or future release is compromised, installation or import of the resolved package could execute attacker-controlled code.

Attack Path

1. An attacker compromises a dependency publisher account or the relevant package distribution process.
2. The attacker publishes a malicious release whose version satisfies the unrestricted minimum-version constraint.
3. A user follows the documented installation instructions or installs requirements.txt.
4. The package resolver selects the malicious release because no exact version or hash is required.
5. Attacker-controlled package code executes during installation or when the extraction scripts import the affected dependency.

This path requires an external supply-chain compromise; the audited repository does not itself retrieve an untrusted custom pac ...[truncated 505 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each direct dependency to a reviewed exact version rather than using unrestricted minimum versions.
2. Generate and commit a reproducible lockfile that includes transitive dependencies.
3. Record cryptographic hashes and install with hash verification, such as:

   bash

   pip install --require-hashes -r requirements.txt
   

4. Update SKILL.md so its installation commands reference the reviewed dependency manifest rather than installing unconstrained packages directly.
5. Perform dependency updates through a controlled review process that includes vulnerability scanning, changelog review, and testing.
6. Install and run the Skill in a least-privileged, isolated environment with restricted filesystem and network access.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The implemented code only supports Excel-to-CSV extraction/conversion from a specified sheet, with an optional row limit. This partially fits the Excel extraction portion of the description, but materially falls short of the broader declared purpose: there is no PDF handling, no table parsing beyond normal Excel sheet reading, no report generation, and no CSV input processing despite CSV being listed in the description. Therefore the description overstates the skill's capabilities relative to the supplied code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The description claims a broader document-processing skill covering Excel, CSV, PDF, table parsing, data extraction, and report generation. The actual code only implements PDF text/table extraction. While PDF extraction and table parsing are consistent with part of the description, the code does not handle spreadsheet files or generate reports. This is a material scope mismatch between the declared purpose and the implemented behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger description is broad enough to activate on generic mentions of spreadsheets, reports, or PDF extraction, which can cause the skill to be selected outside its intended narrow file-processing use case. Over-broad routing can expose file-handling workflows, dependencies, or automated processing steps in contexts where they are unnecessary or inappropriate, increasing the chance of unsafe data handling or prompt-scope confusion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The instructional content is entirely in Chinese, and the skill does not state that language choice depends on user preference or that the tool is region-specific. This can create an implicit locale constraint without user opt-in, which matches the policy category for language or locale violations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The Chinese 'when to use' section uses ambiguous phrases like '表格', '报表', and '表单' without clear boundaries, which can match many ordinary conversations unrelated to file parsing. In an agent setting, ambiguous triggers can lead to incorrect tool or skill invocation, broadening the attack surface for unintended file operations or mishandling of sensitive user content.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified with a lower bound only, which allows installation of any newer release and prevents reproducible builds. This increases supply-chain risk because vulnerable or breaking versions could be resolved at install time without review, especially in a file-processing skill that handles untrusted documents.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

pandas>=2.0.0
openpyxl>=3.0.0
pdfplumber>=0.10.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 82% confidence

Finding

Because pandas is not pinned, it is impossible to verify from this manifest whether deployment will use a version affected by known advisories. Although the cited pandas issue is disputed and may not apply in many real deployments, the lack of version pinning still creates uncertainty and weakens assurance for a component used in file ingestion workflows.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The openpyxl requirement is unpinned, so different environments may install different versions with different security properties. For a skill that parses spreadsheet files from users, dependency drift raises risk because parser libraries are common targets for malicious file-triggered bugs.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

pandas>=2.0.0
openpyxl>=3.0.0
pdfplumber>=0.10.0

Unverifiable Dependency: openpyxl has 2 known advisory(ies) (CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The manifest does not pin openpyxl, so an affected version with known XML external entity issues could be installed without visibility. This is more dangerous in this skill's context because it processes spreadsheet files, and parser flaws in libraries handling untrusted office documents can be triggered by malicious inputs.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Using an unpinned pdfplumber version permits uncontrolled upgrades and non-reproducible installations. In a PDF-processing skill, that matters because document parsers operate on attacker-controlled input and should be kept to vetted versions only.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

pandas>=2.0.0
openpyxl>=3.0.0
pdfplumber>=0.10.0

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring, installation message, and CLI help strings are all written only in Chinese, which imposes a specific language on users without any opt-in or alternative locale support. The policy allows fixed locale behavior only when it is explicitly justified or when users are given a choice, neither of which appears here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.