Security audit

sn-da-excel-workflow

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Excel-analysis skill, but it broadly routes generic data-analysis requests and repeatedly creates local derived files while applying potentially destructive Chinese-only text cleaning.

Install only if you expect Chinese-language Excel workflows and are comfortable with the agent creating local report files. Before using it on sensitive or mixed-language data, ask the agent to confirm output paths, avoid overwriting files, and preview any text-cleaning rule before exporting results.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Vague Triggers

High

Confidence: 94% confidence
Finding: The trigger conditions are extremely broad and explicitly instruct the agent to proactively use this skill for many generic 'data analysis' or file-analysis requests. That creates skill-routing hijack risk: ordinary requests may be diverted into a file-reading, transformation, and export workflow that performs more actions than the user intended, increasing unnecessary data exposure and workspace side effects.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill writes result files to workspace paths and emits download links, but does not clearly signal this side effect or require confirmation before creating artifacts. In a data-analysis context, silent file creation can surprise users, leave sensitive derived data behind in shared or persistent storage, and expand the data handling surface beyond the original request.

Natural-Language Policy Violations

High

Confidence: 96% confidence
Finding: The cleaning routine removes all non-Chinese characters by default, which is destructive normalization without user opt-in and can silently corrupt multilingual, numeric, identifier, code, or compliance-relevant fields. In a spreadsheet workflow, this can alter records, invalidate downstream analysis, and produce incorrect exports while appearing to be legitimate cleaning.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The skill writes output files to fixed names ("highlighted_report.xlsx" and "outlier_summary.xlsx") without any warning, confirmation, or explicit artifact-handling guidance. In an automated workflow, this can overwrite prior results or create unexpected files containing user data, which is risky even if the code appears intended for normal report generation.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill writes generated chart and Excel report files to disk and exposes their paths without any explicit disclosure, consent, or discussion of retention/visibility. In a data-analysis workflow that likely processes user-supplied spreadsheet contents, this can create unintended persistence of potentially sensitive data and increase the risk of local file exposure, cross-task leakage, or mishandling by downstream tooling.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The skill explicitly configures Chinese font/localization behavior and is described entirely in Chinese without indicating any user-driven language selection. While this is not a classic security flaw, it is a genuine policy/quality issue because it can override user preferences, reduce transparency, and cause the agent to produce outputs in an unexpected language or locale-specific format.

Missing User Warnings

Low

Confidence: 94% confidence
Finding: The skill writes analysis artifacts to local disk (for example, an image and an Excel file) and even suggests generating a download link, but the skill description does not clearly warn users about this side effect. In agent environments, silent file creation/export can expose sensitive spreadsheet contents to unintended persistence, later retrieval, or accidental sharing via downloadable artifacts.

Missing User Warnings

Low

Confidence: 72% confidence
Finding: The skill writes to a fixed filename (filtered_result.xlsx) and then reopens and modifies it, without warning about overwrite behavior or ensuring a unique output path. In an automated agent workflow, this can unintentionally replace prior outputs, mix results across runs, or leak/confuse data when multiple tasks share the same workspace.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill writes analysis results to predictable local files and exposes absolute file:// paths back to the user. In an agent/runtime environment, this can leak filesystem layout, encourage direct local-file access patterns, and expose sensitive processed data to unintended parties if the link is surfaced, logged, or opened in a less isolated context.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The skill writes output image files to disk (`fig.savefig` / `plt.savefig`) using default paths, but the markdown does not clearly warn users that execution produces filesystem side effects. In an agent setting, silent file creation can surprise users, clutter shared workspaces, or overwrite prior outputs if filenames collide, even though the code shown does not appear overtly malicious.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The skill writes a new Excel file to disk and exposes its location without any explicit warning or consent boundary in the markdown description. In an agent setting, undocumented file creation can surprise users, overwrite existing artifacts, or leak local path information through returned download links, especially when the parent workflow encourages automatic invocation.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The skill writes image output files to fixed local filenames without warning the user or checking for existing files. This can silently overwrite prior artifacts in the working directory and may unintentionally persist sensitive derived data on disk, especially in shared or long-lived environments.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The skill exports a CSV summary to a fixed filename without disclosing that analyzed data-derived content will be written locally. In environments handling sensitive spreadsheets, this can leave residual files, enable accidental disclosure through later access, and overwrite existing reports.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill writes analysis artifacts to local disk and emits file:// download links without disclosing this behavior in the skill description. In agent or shared runtime environments, silent persistence can expose sensitive spreadsheet contents to later processes, other users, or unintended retention beyond the task lifecycle.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill example writes files directly into the workspace (`analysis_pie_chart.png`, `analysis_report.xlsx`) and prints an absolute path as a download link, but it provides no warning, consent step, or safe output-directory control. In an agent setting, this can cause unintended file creation or overwriting and may expose local filesystem paths to users or downstream logs.

Missing User Warnings

Low

Confidence: 69% confidence
Finding: The skill performs file writes (`savefig`, `to_parquet`) based on caller-supplied output paths without documenting overwrite behavior or requiring safe path handling. In agentic workflows, silent creation or overwriting of files can cause unintended data loss or clobber existing artifacts, especially when paths are derived from user input or chained subskills.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.