Security audit

Excel大师

Security checks for vulnerabilities and agentic risk

Overview

This Excel helper is mostly a Markdown guide, but it requests broad file and command authority while also adding vague API/OAuth credential guidance outside its core spreadsheet scope.

Review before installing. Use this only for explicit spreadsheet tasks, restrict the agent to named input and output files, keep backups before write operations, and do not provide API keys or OAuth tokens unless you have a specific online-Excel workflow with least-privilege credentials.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The skill documentation contradicts itself by claiming the capability is purely Markdown-driven while the manifest explicitly grants `exec` and other sections instruct local command/script execution. This mismatch can mislead users and automated policy systems into underestimating the skill's execution power, increasing the chance that code execution is triggered in contexts where only passive guidance was expected.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The skill is presented primarily as a local Excel-processing package, but later introduces API-key setup, external connections, and network failure handling without a clear feature boundary. That inconsistency can cause agents or users to supply secrets or enable networked behavior unnecessarily, broadening the trust and attack surface beyond the stated purpose.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The manifest frames the skill as a spreadsheet/file-processing tool, but the body expands it into generic API, OAuth, and networked operations that are not justified by the core use case. Scope expansion of this kind is dangerous because it normalizes broader permissions and operational behavior than users expect from a local document-processing skill.

Context-Inappropriate Capability

Low

Confidence: 88% confidence
Finding: Providing unjustified network/API capability guidance in a local-processing skill creates an unnecessary pathway for credential handling and remote access patterns. Even without explicit malicious code, encouraging broader capability use than required increases exposure to secret leakage and accidental external data transfer.

Vague Triggers

High

Confidence: 95% confidence
Finding: The activation guidance is overly broad, covering generic file processing, document conversion, format conversion, and content extraction. In an agent environment, such expansive triggering language can cause the skill to be invoked for many unrelated requests, exposing powerful tools like `exec`, `read`, and `write` more often than necessary and potentially steering workflows into unsafe execution paths.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The usage guidance describes broad activation conditions without clear boundaries, making it easy for an agent to over-select this skill. Because the skill declares execution and file-modification capabilities, over-broad routing increases the risk of unnecessary file access or command execution in contexts outside the intended spreadsheet tasks.

Static analysis

No suspicious patterns detected.