MaybeAI Sheet CLI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 0.16.2

Overview

The skill appears to match its MaybeAI spreadsheet purpose, but it gives agents broad authenticated power to edit, export, and share sheets while relying on under-scoped install and execution guidance.

Install only after you are comfortable granting the mbs CLI access to MaybeAI sheets through MAYBEAI_API_TOKEN. Prefer a pinned, reviewed CLI version in an isolated environment, confirm targets before writes/deletes, avoid public/editor sharing unless explicitly intended, and avoid unpinned external dashboard scripts for sensitive workbooks.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:28

Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

\ --hash=sha256: ``` Install it with: ```bash pip install --require-hashes -r requirements.txt ``` 3. Ensure transitive dependencies are also pinned and hash-validated using a lockfile generated from a reviewed dependency set. 4. Update `README.md`, `SKILL.md`, and `references/cli-commands.md` consistently so none of them recommend an unpinned installation. 5. Verify package provenance through trusted publishing, protected release workflows, and documented publisher identities. 6. Review each new CLI release before updating the Skill version and dependency lock. The existing PyPI version-existence check is not a substitute for artifact integrity or code review. 7. Where feasible, install the CLI in an isolated virtual environment with only the filesystem and environment access required for the task. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:163

Finding

Dashboard Guidance Permits Unpinned Remote JavaScript Execution

Content

View full analysis

` such as jsdelivr/unpkg/cdnjs/d3js; do not inline full ECharts/D3 bundles into `chart.html`. ``` ### Technical Analysis The Skill explicitly permits dashboard HTML to load executable JavaScript from external CDNs through ` ``` 2. The URL is unversioned, resolves a mutable package alias, or otherwise ...[truncated 1317 chars]

Remediation

View remediation

" crossorigin="anonymous"> ``` 4. Maintain an explicit allowlist containing approved: - CDN domains. - Package names. - Exact versions. - Cryptographic integrity hashes. 5. Reject dashboard specifications containing external scripts that do not match the allowlist. 6. Apply a restrictive Content Security Policy that limits `script-src`, `connect-src`, `img-src`, and related capabilities to the minimum necessary origins. 7. Render custom chart HTML in a sandboxed iframe without same-origin privileges. Do not expose authentication tokens, privileged application APIs, or unnecessary browser storage to that frame. 8. Disable arbitrary outbound network access from chart JavaScript unless explicitly required. 9. Document a dependency-review and rotation process so approved versions and integrity hashes are updated only after security review. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a broad MaybeAI spreadsheet skill centered on the mbs CLI and workbook operations such as inspection, import/export, writes, refreshes, dashboard flows, and sharing. The actual code does none of that. It is a self-contained artifact builder that manually emits XML files for an Excel workbook and zips them into an .xlsx file containing sample Orders, Products, and Report sheets. There is no CLI interaction, no remote URL handling, no cross-workbook operations, no dashboard/chart/image CRUD, and no sharing. This is a materially different primary purpose, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is about end-user spreadsheet manipulation through the MaybeAI sheets CLI. The supplied code does not implement any spreadsheet inspection, import/export, worksheet editing, dashboard refresh, chart/image handling, or sharing behavior. Instead, it is an internal maintenance utility for synchronizing the skill version with the CLI package release and verifying publication on PyPI. This is a materially different primary purpose and accesses different resources (local repo metadata, PyPI, SKILL.md) than described.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/sync_cli_release.py (reported line 63)May include surrounding context.

python

text = skill_path.read_text()
    updated, count = re.subn(r"(?m)^version:\s*.+$", f"version: {version}", text, count=1)
    if count != 1:
        raise SystemExit("Could not update SKILL.md frontmatter version.")
    if updated == text:
        return False
    skill_path.write_text(updated)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill exposes capabilities that clearly involve local file reads/writes and outbound network access, but it does not declare any explicit tool scope such as allowed-tools or permissions. In an agent environment, that mismatch weakens containment and review because operators cannot easily tell what the skill is expected to access, increasing the chance of over-broad execution against local files or remote URLs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill includes commands to change workbook visibility and grant access, including making a workbook public, without requiring a warning or confirmation about privacy and data exposure. In a spreadsheet context that may contain sensitive business or personal data, an agent could follow these instructions and unintentionally disclose documents to unauthorized users or the public internet.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

These examples include making a document public, granting editor access, and removing access, which can materially affect user privacy and system access control. While ownership is noted on L477, the document does not explicitly warn that these commands expose data or alter permissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The raw API escape hatch encourages arbitrary POST access to backend endpoints without strong guardrails, which can enable unsafe mutations, privilege-sensitive operations, or bypass of safer first-class command workflows. In an agent skill context, this is more dangerous because an LLM-driven agent may construct ad hoc requests from user input and perform unintended state-changing actions against remote workbook APIs.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/errors-recovery.md (reported line 177)May include surrounding context.

md

- `mbs excel-worksheet check-error` on formula or report-result worksheets
- optionally `mbs file export`

Do not skip verification after:

- SQL result writes
- formula writes or workbook recalculation

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file explicitly states it should be used for tasks including renaming, deleting, sharing, and exporting spreadsheets, but it provides no safety warning about destructive or privacy-impacting operations. Under the markdown-file criteria for SQP-2, skills that can affect user data or system integrity should disclose such risks to users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The document directs users to sharing commands for permissions changes, but it does not warn that these actions may expose documents to other users or broaden access. For markdown skill documentation, omission of privacy or data-access warnings on sharing behavior fits the missing-warning category.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file includes sharing and visibility commands that can expose a sheet publicly, grant write access, or revoke access from users. The document explains how to perform these actions but does not warn that they can affect confidentiality, collaboration, or availability for other users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation explicitly states that non-empty worksheet sample rows are sent to an LLM and also returned to the caller, but it provides no warning about sensitive data exposure, data minimization, or restrictions on using this flow with confidential workbooks. In a spreadsheet context, sample rows often contain PII, financial records, credentials, or business secrets, so silent transmission to a model and broader disclosure to users creates a meaningful confidentiality risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file says the service generates a Chinese natural-language workbook summary, and later reiterates that the summary is generated in Chinese by the service prompt. This imposes a specific language output without documenting user choice, opt-in, or a justified locale restriction.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The boundary statement explicitly says dashboard/chart layout belongs to another skill, yet earlier documentation provides detailed instructions for dashboard specs, chart HTML requirements, CDN script usage, and dashboard execution flows. That is an active contradiction in the skill's own documentation about whether users should perform chart/dashboard design here or route elsewhere.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file includes commands such as chart delete that remove worksheet objects, but the surrounding documentation does not explicitly warn users that these actions mutate or delete existing workbook content. Under the markdown-file criteria, user-facing descriptions should disclose behaviors that can affect user data or worksheet integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file documents image replace and image delete, both of which can alter or remove existing worksheet media, but it does not include an explicit warning about that impact. In markdown guidance, potentially destructive effects on user data should be disclosed so users understand the consequences before acting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

Commands like dashboard refresh and style worksheet apply perform persistent mutations to workbook content or presentation, yet the markdown does not provide a general warning that these are write operations. Even though some verification steps are recommended, the description omits a direct disclosure of mutation risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document contains a dedicated 'Chinese Rules' section that prescribes behavior in Chinese, but it does not state that language selection is optional or user-driven. This can be interpreted as a locale/language policy issue because the skill content supports a specific language without documenting user choice or a region-specific justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The export section instructs users to write workbook data to a local .xlsx file but does not disclose that exporting creates an additional copy of potentially sensitive data outside the managed system. For markdown files, user-facing documentation should warn about behaviors that affect privacy or data handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The example under 'Write formulas into a new report worksheet' hardcodes non-English worksheet names and labels in a general reference document. Because the skill is not documented as region-specific and does not offer a language/locale choice, this can conflict with organizational language/locale policy expectations for user-facing guidance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example performs a write of a spilling =SQL(...) formula into Report!A1, which can overwrite adjacent cells when the result expands. Although the document later mentions confirming the spill area and warns in the notes that adjacent cells may be overwritten, the usage guidance introduces the write workflow before presenting a prominent upfront safety warning, increasing the chance of accidental data loss by users following the example quickly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.