MiniMax XLSX Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:59 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent spreadsheet generator, but its recalculation helper permanently changes the user's LibreOffice macro profile and can trust or overwrite application-level macro code.

Install only if you are comfortable with the skill running LibreOffice locally and modifying workbooks. Review or sandbox scripts/recalc.py before use, especially on machines with existing LibreOffice macros or enterprise macro controls; a safer design would use a temporary LibreOffice profile and avoid touching the user's shared macro library.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/recalc.py:18

Finding

Untrusted Pre-existing LibreOffice Macro Can Hijack Workbook Recalculation

Content

View full analysis

Sub RecalculateAndSave() ThisComponent.calculateAll() ThisComponent.store() ThisComponent.close(True) End Sub """ try: with open(macro_file, "w") as f: f.write(macro_content) return True except Exception: return False ``` The accepted macro is subsequently invoked: ```python cmd = [ "soffice", "--headless", "--norestore", "vnd.sun.star.script:Standard.Module1.RecalculateAndSave?language=Basic&location=application", abs_path, ] ``` ### Technical Analysis The script treats an existing LibreOffice macro as trusted if its source contains the substring `RecalculateAndSave`. It does not validate the exact macro impleme ...[truncated 2142 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/recalc.py:18

Finding

Recalculation Helper Permanently Modifies and May Overwrite the Shared LibreOffice User Profile

Content

View full analysis

Sub RecalculateAndSave() ThisComponent.calculateAll() ThisComponent.store() ThisComponent.close(True) End Sub """ try: with open(macro_file, "w") as f: f.write(macro_content) return True except Exception: return False ``` ### Technical Analysis The helper writes `Module1.xba` directly into LibreOffice's shared user-level `Standard` macro library. This is global application state, not an execution-scoped temporary location. If `Module1.xba` already exists but does not contain the expected procedure name, the script opens it with mode `"w"` and replaces its entire contents. It does not request consent, create a backup, preserve unrelated user macros ...[truncated 1673 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill explicitly instructs use of powerful capabilities such as shell execution, file reads, and file writes, but it does not declare a restrictive tool scope or permissions boundary. That increases the chance the skill can be invoked with broader-than-necessary authority, enabling command execution on local files and helper binaries without an explicit least-privilege contract.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description says to engage for any task involving tabular data, numeric analysis, or spreadsheet generation, which is broad enough to capture many ordinary requests. Over-broad routing can cause the agent to invoke this high-capability skill in situations where shell/file tooling is unnecessary, expanding exposure to risky operations and making prompt-trigger abuse easier.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The brief mandates that every engagement produce at least one .xlsx file, regardless of whether a spreadsheet artifact is actually needed. This can force unnecessary file creation and associated shell/file activity, making the skill activate and perform side-effectful operations in ambiguous situations where a simpler, safer response would suffice.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script writes executable Basic macro code into the user's global LibreOffice profile and then invokes it against a workbook. This permanently changes local application configuration beyond the scope of the current task, increases the attack surface for future LibreOffice use, and can conflict with user security expectations or enterprise macro policies.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code silently creates a macro in the user's LibreOffice profile and saves the workbook as part of recalculation, but the interface and output do not clearly warn that both local application state and the target file will be modified. In an agent skill context processing user-supplied spreadsheets, this hidden side effect is especially risky because users may expect analysis-only behavior.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/recalc.py (reported line 31)May include surrounding context.

python

return True

    if not os.path.exists(macro_dir):
        subprocess.run(["soffice", "--headless", "--terminate_after_init"], capture_output=True, timeout=10)
        os.makedirs(macro_dir, exist_ok=True)

    macro_content = """<?xml version="1.0" encoding="UTF-8"?>

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/recalc.py (reported line 85)May include surrounding context.

python

if platform.system() == "Darwin":
            # Check if gtimeout is available on macOS
            try:
                subprocess.run(["gtimeout", "--version"], capture_output=True, timeout=1, check=False)
                timeout_cmd = "gtimeout"
            except (FileNotFoundError, subprocess.TimeoutExpired):
                pass

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/recalc.py (reported line 92)May include surrounding context.

python

if timeout_cmd:
            cmd = [timeout_cmd, str(timeout)] + cmd

    result = subprocess.run(cmd, capture_output=True, text=True)

    if result.returncode != 0 and result.returncode != 124:  # 124 is timeout exit code
        error_msg = result.stderr or "Unknown error during recalculation"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Line L064 prescribes a region-specific presentation rule based on market locale: mainland China must use red for gains and green for losses, while all other markets must use the reverse. This is a natural-language locale policy constraint presented as non-optional, and the file does not offer user choice or opt-in.

Content

No source excerpt is available for this finding.