xlsx

• Outcome: Review
• Latest audit: Aug 11, 2026 · 11:30 AM UTC
• Version: 1.0.0

Overview

The skill is mainly for spreadsheet work, but it bundles and exposes broader Office-document tooling plus persistent LibreOffice changes that deserve review before installation.

Install only if you are comfortable with a spreadsheet skill that runs local Python and LibreOffice, modifies workbook files during recalculation, writes a persistent LibreOffice macro, and includes off-scope Word/PowerPoint Office tooling. Use it on trusted files and review or remove the non-spreadsheet scripts if you only need XLSX support.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

src = Path(tempfile.gettempdir()) / "lo_socket_shim.c"
    src.write_text(_SHIM_SOURCE)
    subprocess.run(
        ["gcc", "-shared", "-fPIC", "-o", str(_SHIM_SO), str(src), "-ldl"],
        check=True,
        capture_output=True,

• Confidence: 87% confidence
• Finding: subprocess.run( ["gcc", "-shared", "-fPIC", "-o", str(_SHIM_SO), str(src), "-ldl"], check=True, capture_output=True, )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

elif platform.system() == "Darwin" and has_gtimeout():
        cmd = ["gtimeout", str(timeout)] + cmd

    result = subprocess.run(cmd, capture_output=True, text=True, env=get_soffice_env())

    if result.returncode != 0 and result.returncode != 124:  
        error_msg = result.stderr or "Unknown error during recalculation"

• Confidence: 92% confidence
• Finding: result = subprocess.run(cmd, capture_output=True, text=True, env=get_soffice_env())

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return True

    if not os.path.exists(macro_dir):
        subprocess.run(
            ["soffice", "--headless", "--terminate_after_init"],
            capture_output=True,
            timeout=10,

• Confidence: 82% confidence
• Finding: subprocess.run( ["soffice", "--headless", "--terminate_after_init"], capture_output=True, timeout=10, env=get_soffice_env(), )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructions explicitly direct use of Python, filesystem access, environment assumptions, and shell execution (`python scripts/recalc.py`) while declaring no permissions. That mismatch weakens containment and review controls because a caller or platform may treat the skill as lower-risk than it actually is, enabling unintended file access or command execution paths.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The skill is presented as spreadsheet-only, but the detected behavior extends into DOCX/PPTX processing, XML/XSD validation, LibreOffice runtime manipulation, and use of an LD_PRELOAD shim with a compiled shared library. This expands the trusted attack surface far beyond user expectations, increasing the risk of unsafe document handling, privilege boundary bypass attempts, or hidden functionality being invoked under an innocuous spreadsheet label.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The file advertises and implements unpacking for DOCX and PPTX even though the skill is explicitly scoped to spreadsheet inputs/outputs. In an agent setting, this scope drift can cause the wrong tool to trigger on non-spreadsheet documents, expanding the attack surface and enabling unintended handling of Word/PowerPoint content outside the declared trust boundary.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Importing Word-specific transformation helpers into a spreadsheet-scoped skill introduces functionality unrelated to XLSX handling and increases the chance that document-editing behavior is invoked in the wrong context. This is dangerous because it broadens capabilities beyond the declared purpose, making misuse, misrouting, or unsafe document modification more likely.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: At runtime, the suffix check explicitly allows .docx and .pptx files, so the code will process non-spreadsheet Office documents despite the manifest promising spreadsheet-only behavior. In an automated agent environment, this mismatch can be exploited to feed unexpected document types through the skill, bypassing policy assumptions and increasing exposure to malformed or sensitive non-spreadsheet content.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The CLI help and argument descriptions present the tool as a generic Office-file unpacker, which conflicts with the spreadsheet-only skill contract. Misleading operator-facing text is dangerous in agent ecosystems because it encourages off-scope use, causes incorrect routing and expectations, and masks the true breadth of supported document processing.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The script advertises support for .xlsx input in its CLI/help text and unpacking logic, but the dispatch logic only implements validators for .docx and .pptx, rejecting .xlsx at runtime. This inconsistency is a real security-relevant issue because downstream agents or users may rely on validation that never actually occurs, creating a false sense of assurance for spreadsheet files in a spreadsheet-focused skill.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The inline documentation and argument help explicitly state that .xlsx is supported for both the primary path and --original, but later control flow falls through to an error for that file type. In this skill context, that mismatch is more dangerous because the skill is specifically intended for spreadsheet handling, so operators may assume spreadsheet validation protections exist when they do not.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements DOCX/Word XML validation and repair logic inside a skill whose manifest is explicitly for spreadsheet handling. That mismatch expands the skill's effective capability beyond its declared scope, increasing the risk of unintended invocation on non-spreadsheet content and enabling silent processing or modification of Word documents where users and reviewers would not expect it.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The module docstring states that the component performs validation, but the class also includes repair functions that rewrite XML in place, including random replacement of durable IDs. This discrepancy is dangerous because operators may trust the component as read-only while it can mutate user documents, causing integrity issues, unexpected data changes, or hidden side effects during supposedly safe validation workflows.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This file implements a PowerPoint XML validator inside a skill whose manifest is explicitly spreadsheet-focused. That mismatch expands the skill’s effective scope beyond what users and reviewers would expect, which can hide unsupported document-processing behavior and weaken trust, review accuracy, and policy enforcement. In a security-sensitive agent setting, capability drift like this is dangerous because non-manifested code paths may be invoked on attacker-controlled files without appropriate scrutiny.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements Word redlining validation inside a skill declared as spreadsheet-focused, which is a clear scope mismatch. Capability drift like this is dangerous because hidden or unjustified code paths increase review blind spots and can conceal unrelated document-processing behavior that users and defenders would not expect in this skill.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: A spreadsheet-focused skill has no obvious justification for invoking external `git diff` subprocesses to analyze Word-document text, so this adds unnecessary execution capability. Even without direct command injection, unjustified subprocess access broadens the attack surface, inherits trust in the host PATH/environment, and makes abuse or future unsafe modifications easier.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger language is broad enough to activate on casual mentions of spreadsheets, causing the skill to be selected in contexts where spreadsheet file access or modification was not clearly intended. In a skill with code, file, and shell capabilities, over-triggering increases the chance of unnecessary exposure to local files and complex document-processing logic.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script writes a LibreOffice Basic macro into the user's application profile and then uses it to recalculate and save workbooks, without any explicit warning or consent. In a spreadsheet-processing skill, this is especially dangerous because it causes persistent modification of local application state and in-place changes to user files, which can surprise users and expand attack surface for later office automation behavior.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.