Security audit

Excel AI Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local Excel analysis skill, but it should go to Review because it parses user workbooks with a known vulnerable parser and has additional report/installation hardening issues.

Install only if you are comfortable reviewing the package first. Avoid analyzing untrusted or attacker-supplied spreadsheets until the xlsx dependency is replaced or constrained, and treat generated Markdown reports as untrusted if they will be rendered or fed into another AI workflow. Prefer a pinned ClawHub installer version rather than the README's @latest command.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: README.md:24
Finding: Mutable Package Execution Through npx Installation Commands
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: package-lock.json:17
Finding: Dependencies Locked to a Third-Party Registry Mirror
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: index.js:145
Finding: Untrusted Workbook Content Is Embedded in Markdown Without Escaping
Content: View full analysis
{ report += `### ${col}\n`; if (stats.type === 'numeric') { report += `- 类型：数值型\n`; report += `- 有效数据：${stats.count} 条\n`; report += `- 总和：${stats.sum}\n`; report += `- 平均值：${stats.average}\n`; report += `- 最小值：${stats.min}\n`; report += `- 最大值：${stats.max}\n`; report += `- 标准差：${stats.stdDev}\n`; if (stats.missingCount > 0) { report += `- ⚠️ 缺失值：${stats.missingCount}\n`; } } else { report += `- 类型：分类型\n`; report += `- 有效数据：${stats.count} 条\n`; report += `- 唯一值：${stats.uniqueCount} 个\n`; report += `- 前 5 个值：${stats.topValues.map(([v, c]) => `${v}(${c}次)`).join(', ')}\n`; if (stats.missingCount > 0) { report += `- ⚠️ 缺失值：${stats.missingCount}\n`; } } report += `\n`; }); if (analysis.anomalies.length > 0) { report += `## 🚨 异常检测\n\n`; report += `发现 ${analysis.anomalies.length} 个异常值（超过 3 倍标准差）：\n\n`; report += `| 行号 | 列名 | 值 | 偏离倍数 |\n`; report += `|------|------|-----|----------|\n`; analysis.anomalies.slice(0, 10).forEach(a => { report += `| ${a.row} | ${a.column} | ${a.value} | ${a.deviation}σ |\n`; }); } ``` ### Technical Analysis Worksheet column names and categorical cell values originate from an untrusted Excel file. They are interpolated directly into Markdown headings, lists, and tables without escaping Markdown metacharacters or HTML. An attacker can construct a workbook containing values such as Markdown links, remote images, raw HTML, additional headings, table delimiters, or instruction-like text. The resulting report can alter its visible structure and misrepresent attacker-controlled content as analyzer-generated findin ...[truncated 1751 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Known Vulnerable Dependency: xlsx==0.18.5 — 2 advisory(ies): CVE-2023-30533 (Prototype Pollution in sheetJS); CVE-2024-22363 (SheetJS Regular Expression Denial of Service (ReDoS))

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The lockfile pins xlsx to version 0.18.5, which is associated with published advisories including prototype pollution and regular-expression denial of service. In a skill that appears to analyze Excel files, this dependency is directly relevant to likely untrusted workbook input, making exploitation more plausible through crafted spreadsheet content.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: xlsx==0.18.5 — 2 advisory(ies): CVE-2023-30533 (Prototype Pollution in sheetJS); CVE-2024-22363 (SheetJS Regular Expression Denial of Service (ReDoS))

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The package depends on xlsx 0.18.5, which is associated with known advisories including prototype pollution and regular-expression denial of service. In an Excel analysis skill that likely processes untrusted spreadsheet content, these issues are more dangerous because an attacker may be able to trigger process instability, denial of service, or unsafe object property manipulation through crafted files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The README promotes use on sales, financial, operational, and user-behavior spreadsheets, all of which commonly contain sensitive or regulated data, but it gives no warning about privacy, retention, or data handling. This can lead users to submit confidential Excel files without understanding exposure risks, especially in AI-enabled processing workflows.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The README instructs users to run npx clawhub@latest install ..., which fetches and executes the latest package version at install time rather than a pinned, reviewed version. This creates a supply-chain risk: if the package or one of its dependencies is compromised later, users may execute malicious code simply by following the documentation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This second installation command repeats the same unsafe pattern by invoking npx clawhub@latest, causing users to execute whatever code is current at the time they run it. In a README, such copy-pastable commands materially increase exposure to package hijacking or malicious upstream updates.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The usage example "帮我分析这个 Excel 文件" relies on a very generic phrasing pattern ("帮我分析...") without any explicit trigger constraints, exclusion conditions, or narrower invocation context. In a markdown skill description, this can make activation boundaries unclear and increase the risk of unintended invocation from ordinary user requests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The natural-language instructions and usage examples are presented entirely in Chinese, which effectively imposes a language choice on users without documenting opt-in or alternatives. This can violate language or locale policy where users are expected to be offered a language choice unless a locale restriction is justified.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrase '帮我分析这个 Excel 文件' is broad natural language that closely matches ordinary user requests, so the skill could activate unintentionally in situations where the user did not explicitly mean to invoke this specific skill. This can cause unintended file processing and overbroad routing of sensitive spreadsheet content to the skill, especially because the skill handles uploaded Excel files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The report generation hard-codes both the locale (zh-CN) and the report language/content in Chinese, without any user preference or negotiation. This can cause misleading, unusable, or non-compliant output in environments expecting another language or locale, especially where reports are consumed automatically or by users who cannot read Chinese.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JavaScript file contains natural-language strings that force a specific language/locale experience, beginning with the Chinese-only file description and continuing throughout the script's user-facing logs. The policy requires avoiding fixed language constraints unless the skill offers user choice or clearly documents a justified region-specific limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file presents all operational instructions and publishing steps exclusively in Chinese. Under the policy rule for natural-language constraints, forcing a single language without documenting that the skill is intended only for Chinese-speaking users can be a locale/language policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README presents the skill description entirely in Chinese and does not indicate that language selection is optional or that the skill is intended only for a Chinese-speaking or region-specific context. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description is written as a Chinese-only skill description, which indicates a language-specific presentation without any stated user choice or locale justification. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: The dependency is specified with a caret range (^0.18.5), which permits automatic installation of future patch/minor releases within the allowed semver range. This weakens supply-chain determinism and can unexpectedly introduce malicious or vulnerable code if the upstream package or publishing pipeline is compromised.
Content: Scanner excerpt · package.json (reported line 19)May include surrounding context.
json
"author": "oct1st85", "license": "MIT", "dependencies": { "xlsx": "^0.18.5" } }

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The entire report is presented in Chinese, including the title and all section labels, but there is no indication that the user opted into this language or that the skill is intentionally region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.