Maybeai Sheet Cli Skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:51 AM UTC
• Version: v0.21.8

Overview

This is a broad MaybeAI spreadsheet CLI skill whose sensitive powers are disclosed and mostly user-directed, but users should install and use it carefully because it can modify, delete, export, and share spreadsheet data.

Install only if you intend to let mbs operate on MaybeAI spreadsheets with the provided token. Prefer a virtual environment, pin maybeai-sheet-cli to the reviewed version, use a least-privilege token or account where possible, review dry-run output before deletes/overwrites, and require explicit confirmation before making sheets public or granting editor access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:52

Finding

Unpinned External CLI Installation

Content

View full analysis

Remediation

View remediation

``` ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Ensure the version documented in `README.md`, `SKILL.md` frontmatter, and `metadata.cli_version` is consistent. 4. Prefer installation into a dedicated virtual environment or disposable container rather than the system Python environment. 5. Review the package wheel, source distribution, build configuration, and transitive dependency lock before approving a new release. 6. Run the CLI with the minimum filesystem and network permissions required, and provide a narrowly scoped API token where the service supports token scoping. 7. Add automated release checks that reject unpinned installation examples and verify approved package hashes. ]]>

T08 · Insecure Dependencies

Note

• Location: references/charts-formatting.md:177

Finding

Unpinned Playwright Package and Browser Binary Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose presents a general-purpose MaybeAI spreadsheet skill centered on mbs CLI operations across many workbook management capabilities. The actual code does none of that: it simply builds one predefined XLSX file locally from hardcoded data by manually emitting SpreadsheetML XML into a ZIP container. While the generated workbook's contents reference SQL config demo usage, the script itself does not invoke mbs, inspect existing workbooks, import from URLs, write arbitrary ranges/tables, run SQL, refresh data, manage dashboards, or share files. This is not merely a subset implementation detail; the primary function is materially different from the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a runtime skill for performing many spreadsheet and workbook actions through the mbs CLI. The actual code does none of those workbook/data operations. Instead, it reads local markdown documentation files, extracts fenced code-block lines, matches them against a list of disallowed hidden compatibility commands, and exits with pass/fail status. That is a materially different primary purpose and capability set from spreadsheet manipulation, import/export, calculation, dashboard handling, or sharing. Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises end-user spreadsheet manipulation capabilities via the MaybeAI sheet CLI. The supplied code does none of those workbook, worksheet, SQL, dashboard, chart, import/export, or sharing operations. Instead, it serves an internal release-management purpose: checking a CLI package version and syncing the skill metadata version after publication. This is a materially different primary purpose and involves resources not reflected in the description, including local repository metadata files and PyPI. Therefore the description does not accurately represent the behavior of this code chunk.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/sync_cli_release.py (reported line 65)May include surrounding context.

python

text = skill_path.read_text()
    updated, count = re.subn(r"(?m)^version:\s*.+$", f"version: {version}", text, count=1)
    if count != 1:
        raise SystemExit("Could not update SKILL.md frontmatter version.")
    if updated == text:
        return False
    skill_path.write_text(updated)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill explicitly instructs the agent to use a CLI that can read local files, write local artifacts, and access remote URLs, but the manifest defines no explicit tool scope or allowlist. That creates an over-privileged skill boundary where an agent may perform filesystem and network actions beyond what a caller expects, increasing the chance of data exfiltration, unsafe writes, or unintended remote access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest says dashboard design and chart composition should be routed to sheet-dashboard, but this skill later documents dashboard and chart workflows directly. Conflicting boundaries increase the chance that an agent uses the wrong skill for higher-impact actions, bypasses intended review points, or executes broader capabilities than users expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation description is extremely broad and covers inspection, import/export, writes, SQL, refreshes, sharing, images, and dashboards. Overbroad routing can trigger the skill for generic spreadsheet requests, causing the agent to bring file, network, destructive, or sharing capabilities into scope when a narrower or safer skill would suffice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The sharing workflow includes commands to make a workbook public or grant access but does not require a user-facing privacy warning or confirmation about exposing data. In a spreadsheet context, this is particularly risky because workbooks often contain sensitive business or personal information, and a mistaken visibility change can immediately expand access beyond intended recipients.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The later boundary guidance conflicts with earlier workflow sections that instruct direct execution of dashboard/chart workflows. This inconsistency can cause agents to ignore safety partitioning between skills, leading to accidental use of a more privileged or less specialized workflow for dashboard operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This runbook contains concrete data- and schema-modifying commands such as record insert/update, column creation/configuration, formula changes, and SQL materialization with --mode create, but it does not explicitly warn that these operations mutate Base data and structure. In an agent skill context, that omission can cause an automated agent or user to perform destructive or irreversible changes during a task framed as 'verification,' especially because the document mixes safe inspection commands with write operations in one workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/errors-recovery.md (reported line 200)May include surrounding context.

md

- `mbs range inspect` on formula or report-result worksheets
- optionally `mbs workbook export --doc-id <DOC_ID> --out workbook.xlsx`

Do not skip verification after:

- SQL result writes
- formula writes or workbook recalculation

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document first states that Sheet/SQL-result A1 tracing should use mbs range lineage, but later instructs users to use mbs formula lineage for SQL-result cells. That inconsistency can cause an agent to invoke the wrong command family, increasing the chance of failed operations, misleading provenance evidence, or fallback to unsupported/compatibility commands in an automated workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

mbs sql overwrite --doc-id <DOC_ID> --worksheet-name <SQL_RESULT_SHEET> --confirm-overwrite is a destructive write operation, but the reference presents it inline with inspection steps and without an explicit warning that it modifies worksheet contents. In an agent skill, this raises the risk that a user asking only for lineage or evidence gathering triggers materialization that overwrites data, causing unintended state changes or data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file includes security-sensitive sharing operations, including changing visibility to public, granting editor access, and removing access, but it does not provide a user-facing warning about the potential exposure of data or the consequences of changing permissions. Under the markdown criteria for missing user warnings, descriptions that could affect user data, privacy, or system integrity should include such warnings.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The example at L358 uses Chinese text ("记得核对一下") in a user-facing command example, which implicitly steers output/content toward a specific language. The document does not offer a language choice or explain that this example is intentionally locale-specific, so it conflicts with the policy against forcing a language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This reference introduces a full Chinese rules section and Chinese-only examples, which can steer the skill toward a specific language or locale. The file does not state that Chinese is optional, user-selected, or required by a region-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Line L089 hard-codes --language excel in a user-facing example. This is a natural-language locale/language constraint that does not present an opt-in or explain why a specific formula language is required, which can conflict with organizational language-choice policies.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation embeds a concrete developer-local filesystem path (/Users/dengwei/...) that is unrelated to normal end-user spreadsheet operations. While not directly exploitable by itself, it discloses internal workstation structure and repository locations, which can aid reconnaissance, leak employee identity conventions, and encourage agents or users to reference sensitive local paths inappropriately.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code performs a file write to SKILL.md via write_text(), which modifies repository content. Although the script prints a status message afterward, there is no warning before the write and no inline comment or docstring disclosing that it will edit the skill file, so the modifying behavior is not disclosed at the point of action.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.