ClawHub
Back to skill

Security audit

Excel工作室

Security checks for vulnerabilities and agentic risk

Overview

The skill is not overtly malicious, but it asks for command and file access while its Excel-focused purpose is broad, inconsistent, and under-scoped.

Install only if you are comfortable reviewing each invocation carefully. Restrict it to explicit spreadsheet/report tasks, avoid giving it sensitive datasets or API keys unless necessary, and require approval before it runs shell commands or writes files.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill is presented as a specialized Excel/report generator, but the documentation instead describes a generic content-processing skill with broad capabilities and non-Excel outputs. This mismatch can mislead users and downstream agents into granting broader trust or invoking the skill in contexts where command execution and arbitrary content handling are unnecessary, increasing the chance of unsafe use.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill declares exec capability even though its stated purpose is Excel/report generation, and no narrow justification or guardrails are provided. Unnecessary command execution materially increases attack surface because an agent may run shell commands while processing user-controlled content, enabling command abuse, data access, or environment leakage if later paired with unsafe execution logic.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The invocation description is overly broad and lacks clear trigger constraints, which makes it easier for an agent to invoke the skill in unintended contexts. Overbroad activation becomes more dangerous here because the skill also advertises read/write/exec capabilities, so accidental or unnecessary invocation can expose local resources or perform side effects beyond spreadsheet generation.

Static analysis

No suspicious patterns detected.