Security audit
Security checks for vulnerabilities and agentic risk
This spreadsheet skill is purpose-aligned and does not show hidden network, credential, persistence, or destructive behavior, though it can read and write workbook files.
Install only if you want an agent to create, read, edit, and validate spreadsheet files. For important or sensitive workbooks, keep a backup or direct the agent to write a separate output file, because the recalculation helper may update the target workbook's cached formula values.
The skill instructs the agent to access environment variables such as OUTPUT_ROOT and skill_path and to execute Python, but it declares no explicit tool scope or allowed-tools boundary. This weakens least-privilege controls and can let the skill operate with broader runtime capabilities than reviewers or policy expect, increasing the blast radius if the skill is misused or prompt-injected.
The trigger description is broad enough to match many common requests about tables, files, analysis, repair, downloading, or conversion, which can cause the skill to activate when the user did not intend spreadsheet manipulation. Over-triggering is dangerous because this skill can execute code and modify or create files, so accidental invocation can lead to unintended data processing or file changes.
The skill description says it can edit, repair, convert, and write spreadsheet files, including operating on existing files, but it does not clearly warn users about those side effects in the trigger/description area. That missing notice increases the risk of users unintentionally authorizing modification of existing workbooks or creation of new output files, especially when paired with the skill's broad trigger conditions.
The script performs an unexpected in-place modification of the user-supplied workbook by rewriting the XLSX ZIP and injecting cached formula values. In a skill whose stated purpose is recalculation/analysis, this side effect can violate caller expectations, corrupt original evidence/data, and create integrity issues if the function is run on sensitive or untrusted workbooks without explicit consent.
The recalc API documentation states that it recalculates and scans for errors but does not disclose that successful execution may alter the input file on disk. This documentation mismatch is dangerous because downstream callers may invoke it in read-only or forensic workflows, assuming non-destructive behavior, and unknowingly overwrite user data.
The natural-language documentation in the module docstring is presented entirely in Chinese and does not indicate that language selection is optional or limited to a justified region-specific context. This can violate a language/locale policy when a skill effectively assumes a single language without user opt-in.
