Back to skill

Security audit

MaybeAI Sheet

Security checks across malware telemetry and agentic risk

Overview

This MaybeAI spreadsheet skill is transparent about its purpose, but needs review because its example scripts can immediately delete or clear spreadsheet content and change sharing to public/editor without confirmation.

Install only if you are comfortable giving this skill a MaybeAI token that can read, modify, delete, export, and share spreadsheets. Do not run the sample scripts against important documents without editing them first; export or copy the workbook before destructive operations, and avoid public/editor sharing or workbook profiling on sensitive data unless you intend that data flow.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill clearly instructs use of networked API calls via curl and shell scripts, yet the manifest exposes only an environment requirement and no declared permissions boundary. That mismatch is dangerous because it hides the real execution capabilities from reviewers and policy systems, increasing the chance of unintended outbound requests or shell execution without appropriate scrutiny.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The script can instruct the backend to fetch a spreadsheet from an arbitrary remote URL, introducing network-ingest behavior that can be abused to pull attacker-controlled content or trigger backend access to unintended endpoints. In a file-management skill, this expands trust boundaries beyond local user-provided files and can enable SSRF-like behavior depending on backend validation.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill documents share and visibility-changing operations, including making sheets public or private, without requiring an explicit user confirmation or warning about disclosure risk. In a spreadsheet-management context, this is materially dangerous because a user request could be interpreted too broadly and cause accidental exposure of sensitive workbook data to unintended parties.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The document exposes a destructive delete capability as a normal workflow primitive without any warning about permanence, ownership checks, or explicit user confirmation. In an agent skill context, this increases the chance an automated system will invoke deletion based on ambiguous user prompts, causing unintended data loss or deletion of the wrong spreadsheet.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The sharing and visibility section documents permission-changing endpoints without warning that these actions can broaden access to sensitive spreadsheet data or alter who can modify it. In a skill that manages spreadsheets and exports data, omission of privacy guardrails makes accidental oversharing more likely, especially when an agent performs actions on behalf of a user.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The document explicitly states that compact worksheet samples are sent to an LLM, but it does not document any user-facing consent, disclosure, minimization guarantees, or data-classification restrictions before sampled workbook content is transmitted. In a spreadsheet skill, sample rows can easily contain sensitive business, financial, or personal data, so undisclosed forwarding to an LLM creates a real confidentiality and compliance risk.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The script performs file deletion immediately against the API with no confirmation prompt, dry-run mode, or safeguard. This creates a real risk of accidental or automated destructive action, especially because the same script first uploads and manipulates a live document and then deletes it.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script issues a destructive clear_range operation against D1:F10 with no confirmation, dry-run mode, backup step, or explicit warning that data will be removed. In a spreadsheet-management skill, this is more dangerous because users may run example scripts directly against real documents, causing unintended data loss.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The script issues delete_chart and delete_picture operations directly against the remote spreadsheet API with no confirmation prompt, dry-run mode, or guardrails. In an automation context, this increases the chance of accidental destructive changes to user documents and makes misuse easier if the script is invoked with the wrong document or sheet identifiers.

External Transmission

Medium
Category
Data Exfiltration
Content
# ── Import File by URL ───────────────────────────────────────────────────────
echo "=== Import File by URL ==="
curl -s -X POST "$BASE_URL/api/v1/excel/import_by_url" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/data.xlsx"}' \
Confidence
90% confidence
Finding
curl -s -X POST "$BASE_URL/api/v1/excel/import_by_url" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
# ── Delete File ──────────────────────────────────────────────────────────────
echo "=== Delete File ==="
curl -s -X POST "$BASE_URL/api/v1/excel/delete_file" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"uri\": \"$DOC_URI\"}" \
Confidence
96% confidence
Finding
curl -s -X POST "$BASE_URL/api/v1/excel/delete_file" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
}
    }
  }' > "$SUMMARY_CHART_PAYLOAD"
curl -s -X POST "$BASE_URL/api/v1/excel/add_chart" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  --data-binary "@$SUMMARY_CHART_PAYLOAD" | jq .
Confidence
71% confidence
Finding
curl -s -X POST "$BASE_URL/api/v1/excel/add_chart" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ --data-binary

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.