CSV解析生成-免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:34 AM UTC
• Version: 1.0.3

Overview

This CSV helper is not overtly malicious, but it asks for command/API-style authority that is broader than basic CSV parsing needs.

Install only if you are comfortable with a CSV helper that may be selected for broader automation and may have command execution available. Avoid using it on untrusted CSV values that will be opened in Excel or similar spreadsheet apps unless formula-prefixed fields are neutralized separately.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:148

Finding

Spreadsheet Formula Injection in Generated CSV Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 148-177
Vulnerability Type: CSV/spreadsheet formula injection
Risk Level: Medium

Vulnerable Documentation Excerpt

The following is an English translation of the relevant Skill instructions:

text

- Excel-specific defenses: formula injection (`=+-@`), 15-digit precision
  loss, and scientific notation are paid-edition features.

| Formula injection risk | Field starts with `=+-@` |
  The free edition provides no defense; the paid edition adds an apostrophe prefix. |

Q4: How can Excel formula injection be prevented?
The free edition provides no formula-injection defense. The paid edition adds
an apostrophe prefix to fields starting with `=+-@`.

Technical Analysis

The Skill generates CSV data intended for consumption by spreadsheet applications, but it explicitly leaves formula-prefixed fields unmitigated. CSV quoting and RFC 4180 compliance do not prevent applications such as Excel from interpreting cell values beginning with =, +, -, or @ as formulas.

Consequently, an attacker who controls a field value can insert a spreadsheet formula into an otherwise valid CSV record. The generated file can remain syntactically correct while becoming dangerous when opened in a spreadsheet. The Skill also directs users to validate generated files in their target tool, increasing the likelihood that unsafe content will be opened.

Attack Path

1. An attacker controls or influences a value included in data processed by the Skill.
2. The attacker supplies a value beginning with a spreadsheet formula marker, such as =, +, -, or @.
3. The Skill emits the field without spreadsheet-safe neutralization because the documented free workflow provides no defense.
4. A user opens the generated CSV in Excel or another formula-evaluating spreadsheet application.
5. The application interprets the attacker-controlled value as a formula. 6 ...[truncated 819 chars]

Remediation

View remediation

Remediation Suggestions

1. Apply spreadsheet-formula neutralization by default whenever CSV output may be opened in a spreadsheet.
2. Detect dangerous prefixes including =, +, -, and @. Account for leading whitespace, tabs, and control characters that may precede a formula marker.
3. Provide a clearly documented spreadsheet-safe export mode that prefixes dangerous values using a target-compatible mechanism, such as an apostrophe where appropriate.
4. Do not reserve injection prevention for a paid edition; baseline security protections should be enabled in every edition.
5. Warn users when potentially executable spreadsheet content is detected, and report which records and columns were affected.
6. Preserve an explicit raw-data mode only when necessary, require opt-in confirmation, and explain that raw output must not be opened directly in formula-evaluating applications.
7. Add tests covering formula markers, leading whitespace and control characters, quoted formulas, embedded newlines, and application-specific parsing behavior.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:6

Finding

Unnecessary System Command Execution Permission

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6-21
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: Medium

Vulnerable Configuration

yaml

allowed-tools: read exec

tools:
  - exec
  - read
  - write

Technical Analysis

The Skill's stated purpose is basic CSV parsing, generation, and column validation. These operations require data input and output but do not inherently require arbitrary system-command execution. Nevertheless, the front matter grants the exec tool.

Granting command execution unnecessarily expands the authority available while the Skill is active. If the agent misinterprets attacker-controlled data as instructions, is affected by prompt manipulation, or otherwise makes an unsafe tool decision, the available exec capability can turn a data-processing error into system-level command execution within the agent's runtime permissions.

The permission declarations are also inconsistent: allowed-tools lists read and exec, while the separate tools list includes write. Ambiguous permission metadata can cause platforms to grant different capabilities depending on which field they enforce.

No direct malicious command or demonstrated command-injection sink was found in the project. The vulnerability is the unjustified exposure of a high-impact capability and the resulting increase in exploitation scope.

Attack Path

1. The Skill is loaded by an agent platform that honors the declared exec permission.
2. The agent processes attacker-controlled CSV content or accompanying user instructions.
3. Prompt manipulation, unsafe reasoning, or another tool-selection failure causes the agent to treat attacker-controlled content as a reason to invoke a system command.
4. Because exec is already authorized, the agent executes the command rather than being blocked by a least-privilege boundary.
5. The command operates with ...[truncated 824 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec from the Skill because basic CSV processing does not require shell or process execution.
2. Declare only the minimum necessary tools, normally narrowly scoped read and write capabilities.
3. Make allowed-tools and tools consistent so every supported agent platform applies the same permission boundary.
4. Restrict file access to explicit user-selected input and output paths where the platform supports path-level controls.
5. If a future feature genuinely requires command execution, expose a dedicated structured operation rather than a general shell and use a fixed executable and argument allowlist.
6. Never interpolate CSV fields or other user-controlled values into shell command strings.
7. Require explicit user confirmation before any exceptional command execution and run it in a sandbox without unnecessary credentials, network access, or host filesystem access.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is marketed and structured as a simple CSV parsing/generation tool, but later claims broad automation, file handling, API integration, and command execution capabilities. This mismatch can cause an agent or user to grant or use capabilities far beyond the stated purpose, increasing the attack surface and enabling unexpected file, network, or shell operations under a benign-looking skill name.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description uses overly broad invocation language such as data analysis, reporting, insights, visualization, and workflow use, which exceeds the narrow CSV scope. Overbroad descriptions can cause inappropriate auto-selection of the skill in contexts involving broader data access or automation, increasing the chance of misuse and unnecessary permission exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description explicitly states '支持中文交互', and the document repeatedly presents the skill as Chinese-interaction oriented without offering a language choice. This can violate language/locale policy when users have not opted into Chinese or when the agent environment expects language neutrality.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

A basic CSV parser/generator should not require API keys or external API guidance. Introducing API key setup normalizes secret handling and implies outbound service use without clear need, which can mislead operators into exposing credentials or approving unnecessary external access.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document explicitly says the free version lacks formula-injection defenses, yet later advertises built-in security checks and safety compliance. This contradiction can create false trust, leading users to export attacker-controlled CSV content into spreadsheet software where cells beginning with =, +, -, or @ may execute formulas or dangerous links.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Presenting command execution as an inherent capability of a CSV-only skill is unnecessary and risky. It encourages shell access for a task that can usually be completed with in-memory transformation or tightly scoped file operations, making misuse or prompt-induced execution more likely.

Content

No source excerpt is available for this finding.