T07 · Tool Hijacking and Spoofing
Error
- Location
recalc.py:22- Finding
Execution of an Unverified Persistent LibreOffice Macro
- Content
View full analysis
- Remediation
View remediation
Security audit
xlsx
Security checks for vulnerabilities and agentic risk
Overview
The skill is a legitimate spreadsheet helper, but its formula recalculation helper persistently modifies the user's global LibreOffice macro profile without adequate isolation or consent.
Review before installing. Use this only if you are comfortable with a spreadsheet skill that can run LibreOffice and change your LibreOffice macro profile. Prefer an updated version that uses a temporary isolated LibreOffice profile, verifies any macro it invokes, avoids overwriting existing macros, and asks before modifying existing workbooks or application configuration.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
recalc.py:19- Finding
Persistent Overwrite of the Global LibreOffice Macro Module
- Content
View full analysis
Sub RecalculateAndSave() ThisComponent.calculateAll() ThisComponent.store() ThisComponent.close(True) End Sub """ try: with open(macro_file, "w") as f: f.write(macro_content) return True except Exception: return False ``` ### Technical Analysis The setup routine writes executable macro content to a fixed file named `Module1.xba` in the user's global LibreOffice profile. Opening the file with mode `"w"` truncates and replaces any existing module unless the existing file happens to contain the marker string `RecalculateAndSave`. This behavior is broader than required to recalculate one workbook. It modifies another application's persistent user configuration and does not preserve or restore an existing module. The generated macro remains available after the script exits and can affect subsequent LibreOffice sessions. The accompanying workflow describes this as auto ...[truncated 1759 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose is general spreadsheet manipulation, but the documented behavior includes external subprocess execution and modification of LibreOffice macro/configuration on disk. This mismatch is dangerous because users or orchestrators may invoke the skill expecting routine spreadsheet handling while it performs higher-risk side effects that expand persistence and execution surface beyond the stated purpose.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill instructs the agent to write files and invoke shell commands such as running recalc.py and configuring LibreOffice, but it does not declare any explicit tool scope or permissions boundaries. That creates an authorization and review gap: a broadly-triggered spreadsheet skill can gain effective file-write and subprocess capability without clear constraints on what paths, files, or commands are permitted.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The activation criteria are extremely broad, covering nearly any spreadsheet-related task across multiple file types and operations. In context, that increases the chance the skill is auto-selected for benign requests and then exercises file-writing or shell-based recalculation behavior unnecessarily, raising the exposure of those capabilities.
- Content
Behavior Manipulation
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
- Content
CRITICAL: Use Formulas, Not Hardcoded Values
Always use Excel formulas instead of calculating values in Python and hardcoding them. This ensures the spreadsheet remains dynamic and updateable.
❌ WRONG - Hardcoding Calculated Values
python
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill describes editing existing workbooks with operations like insert_rows, delete_cols, overwriting cells, and saving modified files, but it does not require backups, confirmation, or warnings about irreversible changes. In spreadsheet contexts, these actions can silently break formulas, corrupt templates, or destroy user data, especially when combined with automatic save behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script silently writes a global LibreOffice application macro into the user's profile, changing persistent local execution behavior outside the scope of the current task. In a spreadsheet-handling skill that processes potentially untrusted files, modifying application-level macro state without explicit consent increases attack surface, surprises users, and can weaken trust boundaries if other documents later invoke or rely on that macro environment.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python return True if not os.path.exists(macro_dir): subprocess.run(["soffice", "--headless", "--terminate_after_init"], capture_output=True, timeout=10) os.makedirs(macro_dir, exist_ok=True) macro_content = """<?xml version="1.0" encoding="UTF-8"?>
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python if platform.system() == "Darwin": # Check if gtimeout is available on macOS try: subprocess.run(["gtimeout", "--version"], capture_output=True, timeout=1, check=False) timeout_cmd = "gtimeout" except (FileNotFoundError, subprocess.TimeoutExpired): pass
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python if timeout_cmd: cmd = [timeout_cmd, str(timeout), *cmd] result = subprocess.run(cmd, capture_output=True, text=True) if result.returncode != 0 and result.returncode != 124: # 124 is timeout exit code error_msg = result.stderr or "Unknown error during recalculation"
Static analysis
No suspicious patterns detected.