ClawHub
Back to skill

Security audit

Automate Excel

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Excel/CSV automation guide that uses local file access and command execution for spreadsheet work, with no evidence of hidden data access or malicious behavior.

Install only if you want an agent to process local spreadsheet files. Confirm input and output paths before running commands, expect it to install common Python spreadsheet packages, and note that the referenced helper scripts were not included in this artifact.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger keywords listed for this skill are very broad, generic terms such as 'writing', 'reading', and 'automate'. In an agent ecosystem, this can cause the skill to activate for many unrelated requests, expanding the reach of its exec-capable behavior and increasing the chance of unintended file operations or command execution in contexts the user did not intend.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The invocation condition says to apply the skill when a user needs to process Excel files, table data, batch conversion, or report generation, which is broad and ambiguous. Because the skill exposes the 'exec' tool and encourages running local scripts, an imprecise activation rule can lead an agent to select and run this skill in situations where a safer or more narrowly scoped skill should have been used.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.