T08 · Insecure Dependencies
Warning
- Location
SKILL.md:125- Finding
Unpinned and Unnecessary Third-Party Package Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Excel公式工具（免费版）
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a poorly scoped Excel formula helper that asks for command and file access and advertises unrelated automation/API behavior without clear limits.
Install only if you are comfortable reviewing or narrowing the skill first. It should not need shell commands, broad file reads, external APIs, or extra packages for ordinary formula generation; remove exec, restrict file access to user-selected workbooks, and avoid running the pip install commands unless a specific workbook-processing feature requires them in an isolated environment.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:5- Finding
Excessive Command-Execution and File-Access Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The description includes an overly broad trigger for translation/localization tasks unrelated to Excel formulas, which can cause the skill to activate in many unintended situations. Because the skill also advertises read/exec capability, overbroad routing materially increases the chance of privileged tools being made available in contexts that do not need them.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Granting or justifying system command execution for an Excel formula generation/diagnosis skill violates least privilege. In this context, exec is not needed for producing formulas or explaining spreadsheet errors, so its presence materially raises the risk of command misuse, environment probing, or unintended local actions if the skill is invoked by an agent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest description combines Excel-formula functionality with unrelated translation/localization use cases, which misrepresents the skill’s purpose and broadens when agents may invoke it. This kind of scope confusion can cause the skill to be selected in inappropriate contexts, increasing the chance that unnecessary tools like exec/read are exposed during unrelated tasks.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description states '支持中文交互', presenting a language constraint in the skill's behavior without any opt-in or alternative language choice. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy concern unless clearly justified as region-specific.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Generic activation language such as executing core capabilities with configurable create/query/export actions lacks clear boundaries and encourages use as a general-purpose operator. In a skill with read and exec available, ambiguous invocation wording makes misuse more likely because agents may infer broad authority not actually needed for spreadsheet help.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill simultaneously claims no extra API key is needed while its security guidance discusses API-key handling via environment variables. This inconsistency can mislead operators about whether secrets are required, increasing the risk of accidental secret injection, unsafe configuration, or trust in undocumented external dependencies.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation advertises broad file processing, API integration, and command execution capabilities that exceed the stated Excel-formula use case. Overclaiming these capabilities normalizes unnecessary privileged behavior and may prompt an agent to perform filesystem, network, or shell actions unrelated to formula assistance.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Documenting external API/network integration for a formula-focused skill expands its operational scope beyond what users would reasonably expect. This creates unnecessary data exposure risk because spreadsheet content or prompts could be transmitted externally without a strong functional justification.
- Content
Static analysis
No suspicious patterns detected.