Security audit

1

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its spreadsheet-management purpose, but its ready-to-run examples can modify or delete remote spreadsheets without confirmation.

Review before installing. Use this skill only with a MaybeAI token whose permissions are limited to the spreadsheets you intend to manage, and do not run the bundled scripts against production documents unless you have read the whole script and are comfortable with every operation it will perform. Prefer copying or backing up spreadsheets first, and require explicit confirmation before delete, clear, overwrite, export, or worksheet/file-management actions.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/04-rows-columns.sh:20
Finding: Ready-to-run example scripts execute destructive spreadsheet operations without confirmation
Content: View full analysis
Vulnerability Details

File Locations:

SKILL.md:27-35

scripts/01-file-management.sh:44-58

scripts/03-write-data.sh:43-49

scripts/04-rows-columns.sh:20-26

scripts/04-rows-columns.sh:60-66

scripts/05-worksheets.sh:53-59

scripts/07-charts-pictures.sh:76-80

scripts/07-charts-pictures.sh:104-108

Vulnerability Type: Unconditional destructive operations in executable examples
Risk Level: Medium

The documentation presents the scripts as ready-to-run commands:

bash
bash scripts/01-file-management.sh bash scripts/02-read-data.sh bash scripts/03-write-data.sh bash scripts/04-rows-columns.sh bash scripts/05-worksheets.sh bash scripts/06-formulas.sh bash scripts/07-charts-pictures.sh bash scripts/08-formatting.sh bash scripts/09-end-to-end.sh

However, several scripts execute every embedded API operation sequentially, including destructive operations. For example, scripts/03-write-data.sh:43-49 clears a cell range without requesting confirmation:

bash
# ── Clear Range ─────────────────────────────────────────────────────────────── echo "=== Clear Range ===" curl -s -X POST "$BASE_URL/api/v1/excel/clear_range" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{\"uri\": \"$DOC_ID\", \"sheet\": \"Sheet1\", \"range\": \"D1:F10\"}" \ | jq .

scripts/04-rows-columns.sh:20-26 deletes rows unconditionally:

bash
# ── Delete Rows ─────────────────────────────────────────────────────────────── echo "=== Delete Rows ===" curl -s -X POST "$BASE_URL/api/v1/excel/delete_rows" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{\"uri\": \"$DOC_ID\", \"sheet\": \"Sheet1\", \"row\": 5, \"count\": 2}" \ | jq .

scripts/04-rows-columns.sh:60-66 similarly deletes a column:

bash
# ── Delete Columns ─────────────────────────────────────────────────────── ...[truncated 3628 chars]
Remediation: View remediation
Remediation Suggestions

Convert each script into a single-operation command or require an explicit operation argument, such as --delete-rows or --clear-range.

Require an explicit confirmation flag for destructive actions, for example --confirm-delete.

Add an interactive confirmation prompt that displays the document ID, worksheet, range, and exact operation before sending the request.

Default to a dry-run mode that prints the proposed request without submitting it.

Refuse placeholder identifiers such as your_document_id_here and validate all required parameters.

Recommend or automatically create a document copy or recoverable version before destructive changes.

Add prominent warnings to SKILL.md explaining that the scripts currently execute every operation in sequence.

Add strict shell error handling:

bash
set -euo pipefail

Use curl --fail-with-body --show-error so API failures stop execution and remain visible.

Separate read-only demonstrations from mutation and deletion examples. Destructive examples should not run as part of a general-purpose workflow.

Require the user or Agent to explicitly authorize deletion separately from ordinary editing operations.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (78)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The delete operation performs an irreversible remote action with no confirmation, dry-run mode, or safety check. In this skill context, spreadsheet files may be business-critical, so accidental execution can cause data loss or destructive changes in a remote account.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documents and encourages shell-based execution via multiple curl/bash scripts, but the manifest does not declare any tool scope or allowed-tools restrictions. This creates a capability mismatch where an agent may invoke shell access more broadly than users or the platform expect, increasing the chance of unauthorized file/network operations and secret exposure through environment variables.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description authorizes essentially the full spreadsheet lifecycle, including upload, edit, delete, export, versioning, and analysis, with very broad natural-language triggers. Overly broad invocation scope makes it easier for an agent to select this skill for ambiguous requests and perform sensitive or destructive actions on user spreadsheets without strong intent verification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill advertises ready-to-run scripts for uploading, renaming, deleting, editing, and exporting spreadsheets, but provides no confirmation or warning model for destructive operations. In an agent setting, this omission can translate into silent data loss or unintended state changes if the agent follows the examples directly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file delete operation is documented as a simple API call with no warning about irreversibility, recovery limits, or required confirmation. Because this skill manages user documents, normalizing deletion without caution materially raises the risk of accidental or agent-initiated data destruction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script uploads a local Excel file to a remote service without any warning about data sensitivity, third-party transmission, or trust boundaries. In a spreadsheet-management skill, users are likely to handle business or personal data, so silent transmission to an external endpoint increases the risk of unintended data disclosure.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/01-file-management.sh (reported line 21)May include surrounding context.
sh
# ── Import File by URL ─────────────────────────────────────────────────────── echo "=== Import File by URL ===" curl -s -X POST "$BASE_URL/api/v1/excel/import_by_url" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{"url": "https://example.com/data.xlsx"}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/01-file-management.sh (reported line 29)May include surrounding context.
sh
# ── List Files ─────────────────────────────────────────────────────────────── echo "=== List Files ===" curl -s -X POST "$BASE_URL/api/v1/excel/list_files" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/01-file-management.sh (reported line 37)May include surrounding context.
sh
# ── Search Files ───────────────────────────────────────────────────────────── echo "=== Search Files ===" curl -s -X POST "$BASE_URL/api/v1/excel/search_files" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{"keyword": "sales"}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/01-file-management.sh (reported line 46)May include surrounding context.
sh
# ── Rename File ────────────────────────────────────────────────────────────── DOC_ID="your_document_id_here" echo "=== Rename File ===" curl -s -X POST "$BASE_URL/api/v1/excel/rename_file" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{\"uri\": \"$DOC_ID\", \"name\": \"renamed_sales_report.xlsx\"}" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/01-file-management.sh (reported line 54)May include surrounding context.
sh
# ── Delete File ────────────────────────────────────────────────────────────── echo "=== Delete File ===" curl -s -X POST "$BASE_URL/api/v1/excel/delete_file" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{\"uri\": \"$DOC_ID\"}" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 78% confidence
Finding: The export/download call fetches a remote document without any Authorization header, implying either unauthenticated access or undocumented token handling. If the endpoint is publicly accessible by document ID alone, spreadsheet data could be exposed to anyone who can guess or obtain an ID; this is more concerning in a file-management skill dealing with potentially sensitive business data.
Content: Scanner excerpt · scripts/01-file-management.sh (reported line 62)May include surrounding context.
sh
# ── Export (Download) File ─────────────────────────────────────────────────── echo "=== Export File ===" curl -s -o "./exported.xlsx" \ "$BASE_URL/api/v1/excel/export/$DOC_ID" echo "Saved to ./exported.xlsx"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/02-read-data.sh (reported line 24)May include surrounding context.
sh
# ── List Worksheets ─────────────────────────────────────────────────────────── echo "=== List Worksheets ===" curl -s -X POST "$BASE_URL/api/v1/excel/list_worksheets" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{\"uri\": \"$DOC_ID\"}" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/02-read-data.sh (reported line 32)May include surrounding context.
sh
# ── List Worksheets with Version Info ──────────────────────────────────────── echo "=== List Worksheets (with versions) ===" curl -s -X POST "$BASE_URL/api/v1/excel/list_worksheets_version" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{\"uri\": \"$DOC_ID\"}" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/02-read-data.sh (reported line 40)May include surrounding context.
sh
# ── Read Sheet ──────────────────────────────────────────────────────────────── echo "=== Read Sheet ===" curl -s -X POST "$BASE_URL/api/v1/excel/read_sheet" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{\"uri\": \"$DOC_ID\", \"sheet\": \"Sheet1\"}" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/02-read-data.sh (reported line 48)May include surrounding context.
sh
# ── Read Headers ───────────────────────────────────────────────────────────── echo "=== Read Headers ===" curl -s -X POST "$BASE_URL/api/v1/excel/read_headers" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{\"uri\": \"$DOC_ID\", \"sheet\": \"Sheet1\"}" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/02-read-data.sh (reported line 56)May include surrounding context.
sh
# ── List Versions ───────────────────────────────────────────────────────────── echo "=== List Versions ===" curl -s -X POST "$BASE_URL/api/v1/excel/list_versions" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{\"uri\": \"$DOC_ID\"}" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/02-read-data.sh (reported line 64)May include surrounding context.
sh
# ── Read a Specific Version ─────────────────────────────────────────────────── echo "=== Read Version ===" curl -s -X POST "$BASE_URL/api/v1/excel/read_version" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{\"uri\": \"$DOC_ID\", \"version\": \"v1\"}" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/03-write-data.sh (reported line 13)May include surrounding context.
sh
# ── Update Range ────────────────────────────────────────────────────────────── echo "=== Update Range ===" curl -s -X POST "$BASE_URL/api/v1/excel/update_range" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script sends a bearer API token and document identifier to a remote service in multiple curl requests without any user-facing notice, host validation prompt, or guidance about the sensitivity of the data being transmitted. In the context of an agent skill that may be run by users as-is, this increases the risk of unintentional credential and document disclosure to an external platform.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/03-write-data.sh (reported line 31)May include surrounding context.
sh
# ── Update Range by Lookup ──────────────────────────────────────────────────── # Finds the row where lookup_column == lookup_value and updates the given fields echo "=== Update Range by Lookup ===" curl -s -X POST "$BASE_URL/api/v1/excel/update_range_by_lookup" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script performs destructive write operations such as clear_range and write_new_sheet directly against a remote spreadsheet without any confirmation, dry-run mode, backup step, or guardrails. This creates a realistic risk of accidental data loss or unintended overwrites if the wrong DOC_ID, sheet, or range is provided.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/03-write-data.sh (reported line 45)May include surrounding context.
sh
# ── Clear Range ─────────────────────────────────────────────────────────────── echo "=== Clear Range ===" curl -s -X POST "$BASE_URL/api/v1/excel/clear_range" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{\"uri\": \"$DOC_ID\", \"sheet\": \"Sheet1\", \"range\": \"D1:F10\"}" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/03-write-data.sh (reported line 53)May include surrounding context.
sh
# ── Append Rows ─────────────────────────────────────────────────────────────── echo "=== Append Rows ===" curl -s -X POST "$BASE_URL/api/v1/excel/append_rows" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/03-write-data.sh (reported line 68)May include surrounding context.
sh
# ── Write New Sheet (full data at once) ─────────────────────────────────────── echo "=== Write New Sheet ===" curl -s -X POST "$BASE_URL/api/v1/excel/write_new_sheet" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Remediation Suggestions

SkillSpector

Missing User Warnings

Undeclared Tool Scope

Vague Triggers

Missing User Warnings

Missing User Warnings

Missing User Warnings

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Missing User Warnings

External Transmission

Missing User Warnings

External Transmission

External Transmission

External Transmission

Static analysis