ClawHub
Back to skill

Security audit

Excel全能工具箱

Security checks for vulnerabilities and agentic risk

Overview

This spreadsheet skill is mostly purpose-aligned, but it has unsafe automatic installation and file/password handling that users should review before installing.

Install only if you are comfortable with local spreadsheet scripts that can read and write arbitrary files you point them at. Run it in a dedicated environment, install dependencies manually from the pinned requirements file, avoid command-line passwords, always specify a separate output path, and keep your own backups before using encryption, decryption, protection, cleaning, splitting, or merge features.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Error
Location
scripts/utils.py:23
Finding

Automatic Installation of Mutable Runtime Dependencies

Content
View full analysis

Vulnerability Details

File Location: scripts/utils.py:23-29, 52-62
Vulnerability Type: Unsafe runtime dependency installation
Risk Level: High

Complete Code Snippet

python
REQUIRED_PACKAGES = {
    "openpyxl": "openpyxl>=3.1.0",
    "pandas": "pandas>=2.0.0",
    "xlsxwriter": "xlsxwriter>=3.1.0",
    "xlrd": "xlrd>=2.0.0",
    "msoffcrypto": "msoffcrypto-tool>=5.0.0",
    "numpy": "numpy>=1.24.0",
}
python
if auto_install:
    print(f"[自动安装] 检测到缺失依赖，正在安装: {', '.join(missing)}", file=sys.stderr)
    import subprocess
    try:
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "--quiet",
             "--disable-pip-version-check"] + missing,
            stdout=subprocess.DEVNULL,
            stderr=subprocess.PIPE,
            timeout=120
        )
        print("[自动安装] ✅ 依赖安装完成", file=sys.stderr)

The automatic installation is invoked by convert.py:257, peek.py:269, read_excel.py:249, and write_excel.py:232.

Technical Analysis

When any required import is unavailable, the Skill automatically invokes pip without requiring explicit approval. Although scripts/requirements.txt contains exact versions, this runtime installation path does not use that file. Instead, it uses open-ended minimum constraints such as pandas>=2.0.0.

Pip therefore resolves whichever currently available versions satisfy those constraints from the configured package index. No package hashes, immutable lock file, trusted-index restriction, or isolated environment is enforced. Python packages may execute installation or build logic, and their imported modules execute with the same operating-system privileges as the Agent.

This is a supply-chain weakness rather than evidence that the currently named packages are malicious.

Attack Path

  1. One or more required packages are absent from the Agent's Python environment.
  2. The Agent invo ...[truncated 897 chars]
Remediation
View remediation

Remediation Suggestions

  1. Disable automatic dependency installation by default.
  2. Require explicit user confirmation before making network requests or modifying the Python environment.
  3. Install dependencies from the exact-version manifest rather than constructing open-ended package specifications in code.
  4. Generate a lock file containing hashes and install with hash verification, such as pip install --require-hashes.
  5. Restrict package retrieval to an explicitly configured trusted index.
  6. Install dependencies inside a dedicated virtual environment with minimal filesystem and network permissions.
  7. Separate dependency setup from spreadsheet processing so ordinary file inspection cannot silently modify the environment.
  8. Record the resolved dependency versions and source index for auditability.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/protect.py:178
Finding

Password Protection Tool Defaults to Destructive In-Place Writes Without Backup

Content
View full analysis

Vulnerability Details

File Location: scripts/protect.py:178-210
Vulnerability Type: Unsafe file overwrite and missing backup enforcement
Risk Level: High

Complete Code Snippet

python
parser.add_argument('--output', help='输出文件路径（不指定则覆盖原文件）')
parser.add_argument('--mode', required=True,
                    choices=['encrypt', 'decrypt', 'sheet-protect', 'sheet-unprotect'],
                    help='操作模式: encrypt(文件级加密), decrypt(文件级解密), '
                         'sheet-protect(Sheet级保护), sheet-unprotect(移除Sheet保护)')
parser.add_argument('--password', required=True, help='密码')
parser.add_argument('--sheet-protect', nargs='*', dest='sheets',
                    help='保护指定 Sheet（不指定则保护所有 Sheet）')
parser.add_argument('--allow', nargs='*',
                    choices=['select_cells', 'sort', 'filter',
                             'insert_rows', 'delete_rows', 'format_cells'],
                    help='允许的操作列表')

args = parser.parse_args()

# 校验输入
if not os.path.exists(args.input_file):
    print(f"❌ 输入文件不存在: {args.input_file}")
    sys.exit(1)

output_file = args.output or args.input_file

# 确保输出目录存在
output_dir = os.path.dirname(output_file)
if output_dir:
    os.makedirs(output_dir, exist_ok=True)

print(f"📄 输入: {args.input_file}")
print(f"📄 输出: {output_file}")
print(f"🔧 模式: {args.mode}\n")

if args.mode == 'encrypt':
    encrypt_file(args.input_file, output_file, args.password)
elif args.mode == 'decrypt':
    decrypt_file(args.input_file, output_file, args.password)
elif args.mode == 'sheet-protect':
    protect_sheets(args.input_file, output_file, args.password,
                   sheet_names=args.sheets, allow_operations=args.allow)
elif args.mode == 'sheet-unprotect':
    unprotect_sheets(args.input_file, output_file, args.password,
                     sheet_names=args.sheets)

Technical Analysis

If --output is omitted, the destination is ...[truncated 1861 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require an explicit output path and reject input and output paths that resolve to the same file.
  2. If in-place operation is necessary, first create and verify a backup in the same filesystem.
  3. Write transformed content to a securely created temporary file in the destination directory.
  4. Close and validate the temporary workbook before replacing the destination.
  5. Use an atomic replacement operation only after all processing succeeds.
  6. Preserve the temporary or backup file when validation or replacement fails.
  7. Apply the same safe-write implementation consistently to encryption, decryption, sheet protection, and sheet unprotection.
  8. Add tests for omitted --output, identical paths, interrupted writes, incorrect passwords, and insufficient disk space.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/utils.py:305
Finding

Backup Failure Does Not Prevent Destination Overwrite

Content
View full analysis

Vulnerability Details

File Location: scripts/utils.py:305-320
Vulnerability Type: Fail-open backup handling
Risk Level: Medium

Complete Code Snippet

python
# 如果目标文件已存在，先备份
if path.exists():
    backup_name = f"{path.stem}_backup_{datetime.now().strftime('%Y%m%d_%H%M%S')}{path.suffix}"
    backup_path = path.parent / backup_name
    try:
        shutil.copy2(path, backup_path)
        print(f"[信息] 已备份原文件到: {backup_path}", file=sys.stderr)
    except Exception as e:
        print(f"[警告] 备份失败: {e}", file=sys.stderr)

# 确保输出目录存在
path.parent.mkdir(parents=True, exist_ok=True)

# 写入文件
try:
    wb.save(str(path))
    return str(path)
except Exception as e:
    raise IOError(f"文件写入失败: {e}")

Technical Analysis

safe_write() attempts to back up an existing destination, but catches every backup exception and continues to overwrite the destination. Backup failure is therefore treated only as a warning.

This is a fail-open design: the safety control is bypassed precisely when it cannot protect the original file. Possible causes include insufficient disk space, permission errors, filename collisions when multiple writes occur during the same second, filesystem faults, or destination-directory restrictions.

The subsequent wb.save() also writes directly to the final path rather than using a validated temporary file and atomic replacement. Consequently, both backup failure and interrupted writes can leave the destination unrecoverable.

Attack Path

  1. A destination spreadsheet already exists.
  2. Backup creation fails because of permissions, storage exhaustion, a filename collision, or another filesystem error.
  3. The exception is caught and printed as a warning.
  4. Execution continues to wb.save() using the original destination path.
  5. The existing file is overwritten despite the absence of a valid backup.
  6. If saving fails or produces an invalid file, the prior ...[truncated 548 chars]
Remediation
View remediation

Remediation Suggestions

  1. Abort the operation if backup creation fails.
  2. Verify that the backup exists, has a nonzero expected size, and can be opened before modifying the destination.
  3. Use collision-resistant backup names containing microseconds or securely generated random values.
  4. Write the new workbook to a temporary file in the destination directory.
  5. Validate the temporary workbook before atomically replacing the destination.
  6. Flush and synchronize critical output before replacement where durability is required.
  7. Report the backup path and final replacement status as structured results.
  8. Add concurrency, disk-full, permission-denied, and interrupted-write tests.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (57)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

This code does operate on Excel/CSV data, so it is related to the declared spreadsheet domain. However, the description claims a comprehensive Excel toolbox with many editing/transformation/output capabilities, while the supplied code chunk only performs analytical summarization of tabular data and writes a report. It does not manipulate workbook structure, apply Excel formatting/features, generate charts/pivots, compare files, encrypt files, or fill templates. Because the declared purpose materially overstates the implemented functionality and the actual primary behavior is a narrower analysis utility, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The description substantially overstates the functionality of the supplied code chunk. The code only implements tabular file conversion among xlsx/csv/json/markdown/tsv, plus minor XLSX output formatting such as bold headers, centered header alignment, auto column width, and frozen first row. It does not implement the majority of the declared Excel-toolbox features, especially advanced spreadsheet operations like merging, splitting, lookup/joining, deduplication, cleaning, validation, template generation, formulas, charts, pivot tables, analysis, comparison, image insertion, or encryption/password protection. This is a material description-behavior mismatch because the described primary purpose is a comprehensive Excel toolkit, while the actual behavior is a limited format conversion utility.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

该代码块的实际功能非常单一且明确：它是一个“智能预览”脚本，用于查看 Excel/CSV/TSV 文件结构与少量样本数据。它不会修改文件，也不提供声明中列出的绝大多数核心能力。虽然“预览”属于声明能力集合中的一部分，但整体描述将该技能包装为覆盖几乎所有 Excel 操作场景的全能工具箱，并指定所有 Excel/表格相关请求都应触发；而当前代码只能完成预览，主能力范围远窄于声明。因此描述未准确代表该代码块的实际行为，属于明显能力夸大和触发范围不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The supplied code is specifically a spreadsheet data-quality validator, not a general-purpose Excel toolbox. It supports reading Excel/CSV, loading validation rules, checking fields against those rules, and generating reports. While '校验/validation' is one item within the declared description, the declaration materially overstates the implemented functionality by presenting a comprehensive toolbox covering many unrelated spreadsheet operations that are not present in this code chunk. This is a description-behavior mismatch because the actual primary purpose is significantly narrower than the declared purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation policy explicitly says almost any mention of Excel, tables, xlsx, or csv should trigger the skill, even if the user did not ask for this toolbox. Overly broad activation can cause unintended handling of sensitive spreadsheets, surprise file operations, and inappropriate tool execution in contexts where a narrower or different tool should be used.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md
必读文件：`SKILL.md`

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · index.html (reported line 112)May include surrounding context.

html
</head>
<body>

<!-- Nav -->
<nav>
  <div class="nav-inner">
    <div class="nav-logo">📊 <span>mu-excel-toolbox</span></div>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · index.html (reported line 152)May include surrounding context.

html
</div>
</section>

<!-- Core Features -->
<section id="features">
  <div class="container">
    <div class="section-header center fade-up">

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/clean.py (reported line 106)May include surrounding context.

python
print(f"  支持的类型: {SUPPORTED_RULES}")
            sys.exit(1)

    return rules


def rule_remove_empty_rows(df, rule):

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The sheet-unprotect path accepts a password parameter but never validates it before clearing worksheet protection flags. As a result, anyone who can run the tool can remove sheet protection from a workbook regardless of the supplied password, which defeats the security guarantees implied by the feature and can lead to unauthorized modification of sensitive spreadsheets.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger examples in this section are broad enough to match ordinary spreadsheet-related requests without a clearly bounded activation rule. In an agent environment, this can cause unintended invocation on routine conversations or files, increasing the chance of unnecessary file access, modification, or handling of sensitive spreadsheet data beyond user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The statement that the skill 'auto-routes to the right tool' does not define when the skill should activate versus when the agent should answer normally. That ambiguity can lead to over-invocation and automatic selection of file-processing actions without sufficiently explicit user authorization, especially risky given the skill supports write, compare, and encryption operations on local files.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README defines activation scope so broadly that nearly any mention of Excel, tables, CSV, or spreadsheet-related work will trigger the skill, even when the user did not explicitly request it. In an agent setting, overbroad routing can cause unintended file access or execution of file-processing actions on sensitive local documents, expanding the blast radius of prompt injection or simple misclassification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The listed trigger phrases include very generic requests like '帮我看看这个Excel', '清理脏数据', and '给我统计摘要', which are insufficiently specific for safe tool selection in a multi-skill agent. This can lead to accidental invocation in ambiguous contexts and unnecessary processing of potentially sensitive spreadsheets, especially because the skill supports powerful operations like file transformation, comparison, and encryption/decryption.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises and instructs shell execution plus file read/write behavior, but it does not declare any explicit tool scope such as allowed-tools or permissions. That weakens least-privilege controls and makes it easier for the skill to inherit broader runtime capabilities than users or the platform may expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
79% confidence
Finding

The skill metadata and instructions are entirely written as Chinese-only operational guidance while also exposing English trigger phrases, but there is no statement that users may choose their preferred language. This can violate language/locale policy when a skill effectively defaults to a specific language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script comment explicitly states that the page will always default to Chinese on fresh load and ignores localStorage or browser language, then calls setLang('zh'). This is a natural-language locale policy issue because it imposes a specific language choice rather than honoring user preference or offering opt-in behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation states that dedup.py will overwrite the original file by default when --output is not provided. In a data-processing skill that may handle important HR, payroll, or business spreadsheets, silent in-place modification can cause irreversible data loss or corruption if the user misunderstands the default behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The examples for protect.py pass the password directly on the command line, which can expose secrets through shell history, process listings, job logs, and audit tooling. Because this skill is intended for sensitive spreadsheets such as salary files, the exposed password could enable unauthorized decryption or misuse of protected documents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The examples embed plaintext passwords directly in command lines for encryption and decryption workflows. This is dangerous because command-line arguments may be exposed through shell history, process listings, logs, screenshots, or copied documentation, and decryption examples also normalize writing sensitive content back to an unprotected file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The module-level natural-language description and user-facing help strings are presented in Chinese only, which effectively fixes the interaction language. Under the policy, language constraints should either be optional for the user or explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The argparse descriptions, argument help text, and printed status/error messages are all in Chinese, so users are not given a language choice for interacting with the tool. This is a natural-language locale restriction rather than a technical necessity visible in the file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

When --output is provided, the tool creates directories and writes the full analysis report to disk, which may include column names, top text values, dates, correlations, and outlier row references derived from user data. Although the write is part of the tool's functionality, there is no user-facing warning that sensitive information from the dataset may be stored in a file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module description and all user-facing CLI/help text are written in Chinese, which imposes a specific language on users. The file does not provide any documented locale selection, fallback, or opt-in mechanism to accommodate other languages.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This Python file contains user-facing natural-language text exclusively in Chinese, including the module description and command-line help, which effectively imposes a specific language on users. The file does not offer language selection, opt-in, or any documented region-specific justification, so it conflicts with the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.obfuscated_code

Potential obfuscated payload detected.

Warn
Code
suspicious.obfuscated_code
Location
scripts/utils.py:123