Security audit
Security checks for vulnerabilities and agentic risk
This skill provides local spreadsheet inspection/reporting helpers and shows no evidence of hidden execution, exfiltration, persistence, or credential access.
Install only if you are comfortable running local Python scripts on spreadsheet files. Prefer writing reports to new filenames, review any generated reports before acting on them, and do not rely on the advertised auto-fix example as an actual workbook repair feature without checking the code and output.
The skill advertises spreadsheet creation and editing workflows, including commands that write modified workbooks, but it does not declare an explicit tool scope such as permissions or allowed-tools. In an agent setting, this can enable unintended file modification because the capability to write files is implied by the documentation but not bounded by policy metadata.
The document begins in Danish ('Excel-værktøj...') and later instructs 'Lever ALTID uden formel-fejl,' indicating a fixed-language presentation without offering the user a language choice. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in.
The skill explicitly promotes automatic workbook repair and output generation using flags like --fix and --out, but it does not warn that workbook contents may be altered. This is risky because an agent may modify formulas or data structures in ways the user did not intend, potentially causing silent corruption or loss of audit integrity.
The script’s docstring, error messages, usage text, and report output are all written in Danish, which imposes a specific language on users without any opt-in or configurable locale. This matches the policy category for language/locale violations because the file does not present the language restriction as optional or clearly justified as region-specific.
The file’s docstring and all user-facing CLI/error output are written in Danish (for example, "FEJL" and "BRUG") with no indication that the skill is intentionally region-specific or that users can opt into another language. This can violate a language/locale policy when a skill imposes a specific language by default without documented justification.
The script's natural-language strings, including title, usage, errors, and status messages, are written in Danish only. This imposes a specific language on users without any opt-in, which matches the locale-policy concern described in the rule.
The usage string at L48 documents only bog.xlsx [--report rapport.md], but the actual call at L49 parses --fix and passes it into check(). This is an intent/documentation mismatch because the inline usage guidance omits a supported operational mode exposed by the code.
The script writes to an arbitrary user-supplied report path with mode w, which will silently overwrite an existing file. In an agent automation context, this can cause unintended data loss or clobber files if the path is derived from unsafe input or generated incorrectly.
No suspicious patterns detected.
