T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:83- Finding
Excessive Google Drive OAuth Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Excel Workflow
Security checks for vulnerabilities and agentic risk
Overview
The skill’s Excel workflow is mostly coherent, but it asks users to grant full Google Drive access and automatically stores/syncs spreadsheet data without enough scoping or retention controls.
Review before installing. Use a dedicated Google account or restricted Drive remote if possible, avoid uploading sensitive spreadsheets unless cloud sync is intended, and check where rclone credentials and the local SQLite tracker are stored. Treat updates as modifying and re-uploading files, and prefer pinned dependencies for installation.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:73- Finding
Unpinned Python Dependency Installation
- Content
View full analysis
- Remediation
View remediation
--hash=sha256: ``` 3. Install dependencies with integrity enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Pin and verify all transitive dependencies, not only the direct package. 5. Use a trusted package index over TLS and avoid untrusted mirrors or additional indexes. 6. Add automated dependency vulnerability scanning and a controlled process for reviewing and updating pinned versions. 7. Ensure installation occurs in a dedicated virtual environment with only the filesystem and network privileges required by the workflow. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (15)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README advertises automatic Google Drive sync and backup but does not warn that user-uploaded spreadsheet contents may be transmitted to an external cloud service. For a skill handling potentially sensitive business data, this can lead to uninformed data disclosure, privacy violations, or policy noncompliance if users assume processing is local-only.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 81% confidence
- Finding
The skill explicitly persists file metadata, formulas, and related state in a local SQLite database and supports reuse across multiple files and sessions. In the context of uploaded spreadsheets, this creates durable retention of potentially sensitive data without clear minimization, retention limits, or access controls, increasing privacy and cross-session data leakage risk.
- Content
md - ✅ **SQLite Tracking** — Track all files, formulas, and metadata in local database - ✅ **Multi-file Support** — Work with multiple Excel files simultaneously - ✅ **Data Analysis** — Query data, read formulas, and analyze structure - ✅ **Mass Operations** — Create formulas for entire columns at once ## Quick Start
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The quick-start flow says an uploaded .xlsx file is 'automatically' analyzed, uploaded to Google Drive, and saved to a local SQLite tracker, but it does not present this as a privacy/data-handling warning requiring explicit user awareness or consent. Because spreadsheets often contain sensitive business or personal data, silent cloud sync and metadata retention can cause unintended disclosure or policy violations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README advertises Google Drive sync and backup of Excel files but does not clearly warn that spreadsheet contents will be transmitted to a third-party cloud service. Because spreadsheets often contain sensitive business or personal data, users may enable the feature without informed consent, creating an avoidable privacy and data-handling risk.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 82% confidence
- Finding
The skill is designed to persist uploaded workbook metadata, formulas, paths, timestamps, and possibly user-associated identifiers in a local SQLite tracker, while also supporting multi-file workflows. In an agent setting, persistent state across sessions can expose prior users' file names, data context, and activity history to later interactions if access controls, scoping, and retention limits are not explicitly defined.
- Content
md - ✅ **SQLite Tracking** — Track all files, formulas, and metadata in local database - ✅ **Multi-file Support** — Work with multiple Excel files simultaneously - ✅ **Data Analysis** — Query data, read formulas, and analyze structure - ✅ **Mass Operations** — Create formulas for entire columns at once ## Quick Start
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill states that uploaded Excel files are 'automatically' uploaded to Google Drive but does not present this as a clear user-facing warning or require explicit consent. Because spreadsheets often contain sensitive business or personal data, silent transmission to a third-party cloud service creates a meaningful privacy and data-handling risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The update workflow modifies user files and re-uploads the changed workbook to Google Drive, but the documentation frames this as normal behavior without a prominent warning about destructive changes and remote synchronization. This can lead to unintended overwrites, propagation of mistakes, and unauthorized cloud storage of updated sensitive data.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Install rclone brew install rclone # macOS sudo apt install rclone # LinuxIssue: "openpyxl not installed"
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Install rclone brew install rclone # macOS sudo apt install rclone # LinuxIssue: "openpyxl not installed"
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The example responses use Russian ruble formatting ("руб") as the default output, which suggests a fixed locale-specific behavior. The README does not say that locale is user-selectable or that the skill is intended only for a Russian-speaking or Russia-specific context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The sample responses present monetary results using 'руб', which imposes a specific language/locale convention even though the skill is described generically and not as region-specific. This can violate language/locale policy when no user preference or regional scope has been established.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The response example reports values in 'руб' despite no indication that the user requested Russian language or currency formatting. This creates an unnecessary locale assumption in natural-language behavior guidance for the skill.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The example output hardcodes Russian ruble formatting, which can mislead users about locale, currency, or regional assumptions if the skill is used in other contexts. While not a direct code-execution issue, undocumented locale forcing can cause incorrect financial interpretation or user confusion in a spreadsheet workflow handling monetary values.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The sample response presents monetary values in 'руб', which imposes a Russian currency/locale format even though the user did not request that locale. This can violate language/locale policy because the skill examples steer agent behavior toward a specific regional convention without offering user choice or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This example again formats amounts using 'руб', suggesting the skill should answer in a specific locale/currency style regardless of user preference. Repeated locale-specific output in guidance can shape agent behavior in a way that conflicts with policy unless the locale is optional or clearly justified.
- Content