Excel Craft Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:30 AM UTC
• Version: 1.0.0

Overview

This Excel-generation skill is mostly coherent, but its broad file-processing routing and unpinned dependency install deserve user review before installation.

Install only if you want an agent to generate local Excel workbooks with Python execution and file-writing ability. Keep use limited to spreadsheet generation, review generated scripts before running them, choose output paths deliberately, and install openpyxl in an isolated environment with a pinned version where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:93

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 93 and 211
Vulnerability Type: Unpinned package installation from a mutable package index
Risk Level: Medium

Vulnerable Code

At line 93:

bash

pip install openpyxl

At line 211:

markdown

| openpyxl | Python library | Required | `pip install openpyxl` |

Technical Analysis

The Skill directs the Agent or user to install openpyxl without specifying an audited version, verifying package hashes, using a lockfile, or explicitly selecting a trusted package index. Consequently, package resolution depends on mutable repository state at installation time.

The dependency is consistent with the Skill's declared Excel-generation functionality, and there is no evidence that the named package is malicious. Nevertheless, unconstrained dependency resolution creates a supply-chain risk: a compromised upstream release, package repository, package maintainer account, or network/package-index configuration could cause an altered package to be installed. Future incompatible versions could also introduce unexpected behavior.

Attack Path

1. An Agent or user follows the setup instructions and runs pip install openpyxl.
2. pip resolves the dependency using the environment's configured package indexes and selects the latest eligible release.
3. An attacker compromises an upstream release, maintainer account, configured index, or package distribution path.
4. The compromised distribution is downloaded and installed because neither its exact version nor its cryptographic hash is constrained.
5. Malicious installation or runtime code executes with the permissions of the account running pip or the generated workbook script.

Impact Assessment

Successful exploitation could execute arbitrary code under the invoking user's privileges. The resulting scope could include access to files, environment variables, workbook input data, and netw ...[truncated 429 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin openpyxl to a reviewed exact version rather than resolving the latest release.

2. Store dependencies in a version-controlled requirements or lock file.

3. Record and enforce cryptographic hashes, for example:

   text

   openpyxl==<reviewed-version> --hash=sha256:<verified-package-hash>
   

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Explicitly use a trusted package index and review any environment-level extra-index configuration.

5. Install the package in an isolated virtual environment under a non-privileged account:

   bash

   python3 -m venv .venv
   . .venv/bin/activate
   python3 -m pip install --require-hashes -r requirements.txt
   

6. Periodically review and deliberately update the pinned version and hashes after security and compatibility testing.

7. Avoid running package installation with administrator or root privileges.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest and description position the skill as a constrained Excel generator, but the activation language expands it into generic file processing, conversion, and content extraction tasks. That scope drift can cause an agent to invoke a skill with write/exec capabilities for unrelated workloads, increasing the chance of unintended file access or script generation outside the intended Excel-only boundary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger text is overly broad and overlaps with many unrelated file-handling tasks, making accidental or policy-bypassing invocation more likely. In a skill with read, write, and exec tools, broad routing language is dangerous because it can channel arbitrary document or conversion requests into a capability set that can create files and execute scripts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is fundamentally designed to generate and save Excel files, but the description near its capability introduction does not clearly warn that it writes files to disk. Missing file-write disclosure reduces informed consent and can lead users or orchestrators to approve actions without realizing persistent filesystem changes will occur.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The coverage keyword list is expansive, repetitive, and lacks meaningful constraints, which can cause the orchestrator to match the skill on weak lexical overlap rather than actual task fit. Because the skill can read, write, and execute code, this kind of over-claiming broadens the attack surface by enabling inappropriate delegation to a high-privilege skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The document states the skill performs all processing locally and does not involve network calls, yet the error-handling section instructs the agent to run ping and troubleshoot connectivity. This inconsistency can normalize unnecessary network-related actions for a skill that also has exec privileges, weakening operator expectations about offline-only behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.