Excel全能工具箱

• Outcome: Review
• Latest audit: Jul 28, 2026 · 6:10 AM UTC
• Version: 1.1.0

Overview

This is a coherent local Excel toolbox, but it needs Review because it broadly auto-triggers and can install packages or modify/encrypt/overwrite sensitive spreadsheets without consistently enforced safeguards.

Install only if you are comfortable with a local Excel automation skill that can read spreadsheet contents, print previews into logs/chats, write or overwrite workbooks, encrypt/decrypt files, and auto-install Python packages. Use explicit output paths, keep independent backups, avoid broad auto-routing on sensitive files, and prefer manually installing pinned dependencies from requirements.txt in an isolated environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"[自动安装] 检测到缺失依赖，正在安装: {', '.join(missing)}", file=sys.stderr)
        import subprocess
        try:
            subprocess.check_call(
                [sys.executable, "-m", "pip", "install", "--quiet", "--disable-pip-version-check"] + missing,
                stdout=subprocess.DEVNULL,
                stderr=subprocess.PIPE,

• Confidence: 95% confidence
• Finding: subprocess.check_call( [sys.executable, "-m", "pip", "install", "--quiet", "--disable-pip-version-check"] + missing, stdout=subprocess.DEVNULL,

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises and routes to scripts that can read files, write/modify files, and invoke shell commands via Python execution and dependency installation, but it does not declare any permissions or trust boundaries. This creates hidden capability expansion: users or orchestrators may invoke the skill without understanding that it can access local files and execute installation commands, increasing the risk of unintended data access or system changes.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The sheet-unprotect path accepts a password argument but never validates it before clearing worksheet protection flags. Anyone who can invoke this tool on a workbook can remove sheet protection regardless of knowing the password, which defeats the advertised access-control behavior and can mislead users into trusting it for sensitive spreadsheets such as payroll or HR data.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file header and feature description present sheet-level protection alongside file encryption in a way that can cause users to believe both provide meaningful password security. In reality, openpyxl sheet protection is a weak edit-restriction mechanism and this script's unprotect logic can remove it without validating the password, so the tool materially overstates protection for sensitive Excel workflows.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: Auto-installing Python packages is not necessary for ordinary Excel file processing and materially expands the attack surface. In an agent skill context, this behavior can modify the execution environment, reach external package repositories, and introduce unreviewed code based on runtime conditions, creating a supply-chain and environment-integrity risk.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The README says the skill should trigger not only when users explicitly request it, but broadly for any Excel/table/xlsx/csv-related task. In agent environments, this kind of vague natural-language activation increases the chance of unintended tool invocation on sensitive files or in contexts where the user did not consent to this specific skill, expanding the attack surface and enabling accidental data processing.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The 'auto-routes to the right tool' language describes autonomous tool selection without documenting constraints, approval gates, or disambiguation rules. In a multi-tool agent, this can cause the skill to act on local spreadsheet data unexpectedly, especially when prompts are ambiguous, leading to unintended reads, writes, encryption, or transformation of user files.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill metadata/README states that Excel- or table-related requests should trigger the skill even if the user does not explicitly invoke it. That activation scope is very broad and can cause unintended routing on ordinary conversations about spreadsheets, increasing the chance that file-processing actions are proposed or initiated in the wrong context.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The feature list uses generic phrases like '帮我看看这个Excel' and other natural-language examples that overlap with common user speech. In agent ecosystems that auto-route based on examples, this can overmatch benign discussion and trigger the skill when the user did not intend to perform file operations.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The README advertises encryption/decryption and other file-modifying capabilities without prominently requiring user confirmation for destructive or high-impact operations. In a skill that edits local files, this can lead to accidental lockout, unintended overwrites, or modification of sensitive business/HR documents.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger scope is extremely broad: it states that essentially any Excel/spreadsheet/xlsx/csv-related request should activate the skill, even if the user did not explicitly ask for it. In an agent environment, this can cause unintended tool invocation on sensitive spreadsheets, expanding access to local data and enabling file reads/writes or shell-backed actions without a clear user opt-in boundary.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The page markets destructive capabilities such as writing new files, splitting workbooks, generating documents, and setting/modifying/removing passwords, but it does not prominently warn that these operations can create, overwrite, transform, or lock user files. In a skill that may be auto-triggered for any Excel-related request, this increases the risk of unintended file modification, data loss, or accidental encryption of sensitive spreadsheets.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The API reference states that `dedup.py` defaults to overwriting the original file (`--output | 覆盖原文件`) without prominently warning about destructive behavior. In a data-processing skill for HR, payroll, and business reports, this can cause irreversible loss of original records or corruption of source data if the deduplication criteria are wrong or misused.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The examples normalize write/append and especially decrypt operations without any caution about overwriting files, exposing sensitive workbook contents, or leaving decrypted copies behind. In an agent-triggered skill that broadly activates on Excel-related requests, this can encourage unsafe handling of payroll, HR, or other confidential spreadsheets and increase accidental data exposure.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Describing automatic bad-row skipping without prominent notice creates a data integrity risk: users may trust outputs that silently omit records, which is especially dangerous for attendance, payroll, HR, or reporting workflows. In an automation context, silent omission can propagate incomplete or misleading results without operator awareness.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script defaults to saving changes back to the input workbook when --output is not provided, which can silently overwrite the original file. In an automation/agent context this is risky because formula insertion is destructive and may permanently alter business spreadsheets, especially if the user expected a preview or a separate output file.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: If `--output` is omitted, the script silently overwrites the input workbook in place. In a data-processing skill that handles business, HR, payroll, and other sensitive spreadsheets, this can cause irreversible data loss or corruption if the operation is misconfigured, interrupted, or applied to the wrong file.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This tool reads spreadsheet/CSV contents and prints headers plus preview rows directly to stdout without any warning, masking, or consent gate. In the stated skill context, it is likely to be used on HR, payroll, attendance, and business-report files, so even a small preview can expose personally identifiable, financial, or otherwise sensitive data in logs, terminals, chat transcripts, or downstream tooling.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The detailed text report includes raw dataset values in the TOP5 summary for text columns, which can expose personally identifiable information, secrets, or other sensitive business content to logs, terminal output, or saved reports. In this skill's context, users are expected to analyze HR, payroll, attendance, and business spreadsheets, so echoing representative values materially increases confidentiality risk.

Ssd 3

Low

• Confidence: 85% confidence
• Finding: Publishing full column names can leak schema details such as fields related to passwords, salaries, ID numbers, or other sensitive business attributes. In an Excel-analysis tool intended for HR, payroll, and operational reports, schema disclosure is plausible and can reveal confidential structure even when row data is not shown.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.obfuscated_code

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: scripts/utils.py:123