Questionnaire Codebook Maker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:17 AM UTC
• Version: 1.0.0

Overview

The skill is coherent and not deceptive, but its spreadsheet-oriented TSV output can preserve formula-leading questionnaire text in a way users should review before installing.

Review this skill before installing if you will process questionnaires from other people. It appears purpose-aligned and local-only, but untrusted CSV fields beginning with spreadsheet formula characters should be sanitized before opening the generated TSV in Excel or similar tools.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/make_codebook.py:110

Finding

Spreadsheet Formula Injection in Generated TSV Files

Content

View full analysis

Vulnerability Details

File Location: scripts/make_codebook.py:110-112
Vulnerability Type: Spreadsheet formula injection
Risk Level: Medium

Vulnerable Code

python

with tsv_path.open("w", encoding="utf-8", newline="") as f:
    writer = csv.DictWriter(f, fieldnames=headers, delimiter="\t")
    writer.writeheader()
    writer.writerows(records)

The records collection contains attacker-controlled values read from the input CSV, including item_id, item_text, and dimension. These values are written directly to variable_map.tsv without neutralizing spreadsheet formula prefixes.

Technical Analysis

Spreadsheet applications may interpret cells beginning with =, +, -, or @ as formulas. An attacker able to provide questionnaire CSV content can place a spreadsheet formula in a textual field. The script preserves that content when generating the TSV.

This is security-relevant because the skill explicitly produces analysis-ready files intended for use in spreadsheet software. CSV quoting does not neutralize formulas: a quoted cell can still be evaluated after the generated TSV is opened or imported into a spreadsheet application.

Exploitation depends on the victim opening the generated file in software that evaluates formulas and on that software's security settings. The precise effects vary by spreadsheet product and version.

Attack Path

1. An attacker supplies or modifies the questionnaire input CSV.
2. The attacker places a formula-leading payload in a field such as item_text, item_id, or dimension.
3. A user runs scripts/make_codebook.py against that CSV.
4. The script copies the value into variable_map.tsv without spreadsheet-safe escaping.
5. The user opens or imports the TSV in Excel or another formula-capable spreadsheet application.
6. The application may evaluate the cell as a formula rather than display it as literal questionnaire text.

Impact Assessment

The script itself does not gain ...[truncated 560 chars]

Remediation

View remediation

Remediation Suggestions

Implement a dedicated spreadsheet-safety function and apply it to every user-controlled textual value before writing TSV output. At minimum:

1. Detect values whose first non-whitespace character is =, +, -, or @.
2. Prefix such values with a single quote or another format-appropriate neutralization marker that the supported spreadsheet applications treat as literal text.
3. Consider additional dangerous leading characters, including tabs, carriage returns, and line feeds, according to the import behavior of supported applications.
4. Preserve the original data separately if exact round-trip fidelity is required.
5. Document the escaping behavior so consumers understand that generated files are spreadsheet-safe representations.
6. Add automated tests covering formula-leading values in every exported user-controlled field.

For example:

python

def spreadsheet_safe(value: str) -> str:
    if value and value.lstrip().startswith(("=", "+", "-", "@")):
        return "'" + value
    return value

Apply the protection while constructing export records or immediately before writer.writerows(records). Do not rely solely on CSV/TSV quoting because quoting does not prevent spreadsheet formula evaluation.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises executable helper-script behavior and implies file input/output via scripts/make_codebook.py, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch can lead to overbroad agent execution or ambiguous enforcement, increasing the risk that an agent reads or writes files beyond what the user expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The script deletes the output directory with rm -rf output, which is a destructive file operation. While this is in a test script and likely expected, the file itself provides no visible warning, confirmation, or explanatory comment about the deletion.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.