ClawHub
Back to skill

Security audit

MiniMax Excel

Security checks for vulnerabilities and agentic risk

Overview

This is a single Markdown-only Excel generation skill whose macro-enabled output risk is disclosed and purpose-aligned, with no hidden execution or persistence found.

Install only if you expect the agent to create Excel workbooks, including possible .xlsm files. Treat generated macro-enabled spreadsheets as executable content: use macros only from trusted requests, review formulas and VBA before sharing or opening broadly, and save generated workbooks under new filenames until verified.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly advertises support for VBA macros, .xlsm files, and embedded automation scripts without any warning, consent flow, or restriction. Because macros are executable code and Excel files are a common malware delivery vehicle, this materially increases the risk of generating or propagating code-bearing spreadsheets that could execute harmful actions when opened by a user.

Missing User Warnings

Low
Confidence
72% confidence
Finding
This markdown file describes generating Excel workbooks, which inherently creates or modifies user data files, yet it provides no warning about reviewing outputs, choosing safe save locations, or avoiding accidental replacement of existing spreadsheets. For markdown files, omissions of warnings about behaviors affecting user data are in scope.

Static analysis

No suspicious patterns detected.