Data Report Generator — CSV/Excel to Word/PDF with Charts

• Outcome: Review
• Latest audit: May 29, 2026 at 9:23 PM UTC
• Version:
  1.0.0

Overview

This spreadsheet reporting skill is mostly coherent, but it can modify the host environment and may activate too broadly, so users should review it before installing.

Install only if you are comfortable letting the agent process selected local spreadsheets and set up reporting dependencies. Prefer a virtual environment or container, avoid approving apt-get or --break-system-packages unless you explicitly want host-level changes, and confirm the skill is needed before using it for simple summaries or charts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill instructs installation of a system package via `apt-get install -y fonts-wqy-zenhei`, which expands execution beyond the stated reporting task and requires elevated package-management access. Even though the package named is a font, allowing skill-driven OS package installation increases supply-chain and host-modification risk, especially in shared or restricted runtimes.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are very broad, including generic requests like analyzing data, making reports, or weekly/monthly reporting, which can cause the skill to activate in situations where the user did not intend this specific workflow. Overbroad activation can lead to unnecessary dependency installation, file handling, and execution of code paths on sensitive datasets when a narrower or safer skill should have been selected.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The activation guidance mixes 'mentions a data file' with later instructions saying to ask for upload if no file is present, creating ambiguity about whether the skill should activate before required input exists. That ambiguity increases unintended invocation risk and may cause the agent to enter a workflow that installs packages or prepares execution steps before confirming the necessary artifact and user intent.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The narrative template hard-codes Chinese/Chinese-English output structure regardless of the user's requested language. In a report-generation skill, this can cause unintended disclosure, user confusion, and quality/safety issues by overriding user intent or organizational language requirements, especially in automated business reporting workflows.

VirusTotal

66/66 vendors flagged this skill as clean.