Security audit

sheet-process

Security checks across malware telemetry and agentic risk

Overview

This Tencent Docs sheet filter matches its stated purpose, but it should be reviewed because it can read connected documents, load code from a hard-coded local path, and save filtered data locally.

Install only if you trust the publisher and are comfortable with the skill reading the Tencent Docs sheets you reference and saving filtered rows as local files. Review or fix the hard-coded /Users/liuliu import path before use, and direct exports to a controlled folder rather than temporary or shared locations.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 79% confidence
Finding: The skill text includes capabilities that write files and invoke code execution paths, yet it declares no permissions or trust boundaries. That mismatch can cause an agent or reviewer to underestimate the skill's ability to access the filesystem or run local code, increasing the chance of unsafe execution in environments where permission declarations are relied upon.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill instructs importing a Python module from a hard-coded absolute local path and then executing it. This creates a dangerous trust boundary violation: if that path or module is modified, the skill can run arbitrary local code under the agent's context, which exceeds normal spreadsheet filtering expectations.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The function writes filtered document contents to any caller-supplied output_path, which can cause unintended local data export outside the expected 'filtering' behavior. In an agent skill context, this is sensitive because spreadsheet data may contain private information and the file write destination is not constrained or clearly disclosed.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The atomic-mode trigger phrases are generic table-operation terms that can easily overlap with normal user requests, causing the skill to activate when the user did not explicitly intend to invoke it. In a skill that can query connected Tencent Docs data and transform outputs for downstream AI nodes, unintended activation increases the risk of unnecessary data access, filtering, and disclosure in contexts where the user only meant to ask a general question.

Vague Triggers

High

Confidence: 90% confidence
Finding: Defaulting to atomic mode when no trigger phrase is present makes the skill eligible to activate on broad, ambiguous conversation context. Over-broad activation can cause unintended document access, table enumeration, or file generation in situations where the user did not clearly invoke this skill.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger phrase '表格处理' is overly generic and likely to match many ordinary spreadsheet-related requests. In a skill that can inspect documents, enumerate sheets, and produce files, such a broad trigger increases the risk of accidental activation and unintended data handling.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This code persists filtered spreadsheet data to local storage without any consent gate, warning, or retention control. In a document-processing skill, local export increases the chance of sensitive business data being copied to world-readable temp locations, backup systems, or unintended downstream processes.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The HTML export writes spreadsheet-derived content to a local file without prominently warning that document contents are being saved outside the source system. In this skill's context, that is risky because the tool processes business spreadsheet data and even filtered subsets may still contain sensitive records or links.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.