Excel 数据自动清洗引擎 Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:59 AM UTC
• Version: 1.0.0

Overview

This Excel-cleaning skill is mostly coherent, but it may send personal phone numbers to external web search during validation without clear consent or limits.

Install only if you are comfortable with the skill reading business spreadsheets and creating cleaned output/report files. For datasets containing phone numbers, names, addresses, or ID numbers, require the agent to keep validation local unless you explicitly approve a specific external lookup and know what data will be sent.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:80

Finding

Potential Disclosure of Personal Data Through External Web Search

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 80–94
Vulnerability Type: Privacy Data Disclosure
Risk Level: Medium

Complete Code Snippet

markdown

## 工具使用

- `read` — 读取原始数据文件
- `exec` — 运行 Python openpyxl/pandas 处理
- `write` — 写出清洗后的文件
- `web_search` — 辅助数据验证（如手机号归属地）

## 常用清洗规则（内置）

| 列类型 | 规则 |
|--------|------|
| 手机号 | 去空格、统一 11 位、验证格式 |
| 日期 | 统一 YYYY-MM-DD、修复乱码日期 |
| 金额 | 去货币符号、统一小数、检测异常 |
| 地址 | 提取省市区、补充邮编 |
| 姓名 | 去空格、统一大小写 |
| 身份证 | 验证校验位、提取生日性别 |

Technical Analysis

The skill instructs the agent to process personal identifiers, including telephone numbers and national identity numbers. It also authorizes use of web_search for data validation and explicitly identifies telephone-number attribution as an example.

A complete telephone number used as a search query is transmitted to an external search service. The instructions do not require informed user consent, masking, data minimization, an approved destination, or confirmation that the relevant search provider may process the data. Local syntax and checksum validation do not require disclosure to an external service.

The document does not explicitly instruct the agent to submit national identity numbers to web search. Therefore, the confirmed concern is limited to telephone numbers; identity-number processing increases the sensitivity of the dataset but is not itself evidence of external disclosure.

Attack Path

1. A user supplies a CSV, XLSX, or JSON file containing telephone numbers.
2. The agent reads the file under the skill's workflow.
3. The agent applies the suggested telephone-number validation or attribution procedure.
4. The agent invokes web_search using a complete telephone number as the query.
5. The external search provider receives the identifier and may retain it in query, telemetry, or access logs.
6. The identifier is consequently disclosed outside the user's local process ...[truncated 713 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove external web search from the default validation workflow.
2. Validate telephone-number length, prefix, syntax, and checksums locally where applicable.
3. Require explicit, informed user approval before any identifier is sent to an external service.
4. Clearly identify the external provider, data sent, processing purpose, retention implications, and expected result before requesting approval.
5. Minimize submitted data by masking, tokenizing, or otherwise reducing identifiers whenever the validation objective permits it.
6. Permit external validation only through approved, allowlisted APIs with suitable authentication, transport security, contractual privacy safeguards, and retention controls.
7. Prohibit submitting national identity numbers or similarly sensitive identifiers to general-purpose search engines.
8. Add logging that records user authorization and the destination without reproducing complete personal identifiers in local logs.
9. Define retention and deletion rules for source files, cleaned outputs, reports, temporary files, and any lookup results.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad, generic, and map to common user requests such as cleaning data or handling Excel, which can cause the skill to activate unintentionally in unrelated conversations. Because the skill can read files and execute Python-based processing, accidental invocation increases the chance of unnecessary file access, unintended data handling, and execution of side-effecting actions without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly describes saving cleaned files and reports but does not warn the user that new output files will be created or clarify whether existing files may be overwritten. In a file-processing skill handling business data, this can lead to unexpected persistence of sensitive transformed data, confusion about where outputs are stored, or accidental replacement of important files if implementation choices are unsafe.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.