Excel Ninja Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.0

Overview

This Excel automation skill is not clearly malicious, but it asks agents to run local commands and install dependencies while the promised scripts and dependency file are missing from the package.

Install only if you are comfortable with an agent running shell commands for local spreadsheet work. Use an isolated Python environment, pin or review dependencies yourself, confirm output paths before running, and be aware that this package does not include the scripts it tells the agent to execute.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:36

Finding

Unpinned and Unverifiable Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36–41
Vulnerability Type: Supply-chain risk caused by unpinned dependencies and an absent dependency manifest
Risk Level: Medium

Vulnerable Code

bash

# Dependency installation
pip install openpyxl pandas xlrd

# Alternatively, use the bundled dependency file
pip install -r scripts/requirements.txt

The same unpinned installation instructions are repeated in the dependency table at SKILL.md, lines 333–335:

markdown

| openpyxl | Python library | Required | `pip install openpyxl` |
| pandas | Python library | Required | `pip install pandas` |
| xlrd | Python library | Optional | `pip install xlrd` |

Technical Analysis

The Skill directs the Agent to install packages from pip's configured package index without exact version constraints or cryptographic hashes. Dependency resolution therefore relies on mutable external artifacts whose contents can change after the Skill has been reviewed.

The alternative command references scripts/requirements.txt, but the audited project contains only SKILL.md. Because the referenced manifest is absent, its package names, versions, transitive dependencies, and integrity controls cannot be audited.

The named packages are legitimate packages, and the audit found no evidence that they are currently malicious. The security issue is the unsafe installation process: package-index compromise, a compromised future release, a malicious configured mirror, or dependency-resolution changes could cause an Agent to install and execute unreviewed code. Python packages may execute build-system code during installation, and installed package code executes when imported by the referenced processing scripts.

Attack Path

1. An Agent loads the Skill and follows its environment-preparation instructions.
2. The Agent runs pip install openpyxl pandas xlrd using its configured package index or mirror.

...[truncated 1040 chars]

Remediation

View remediation

Remediation Suggestions

1. Add the referenced dependency manifest to the project and ensure it is included in security review.

2. Pin every direct and transitive dependency to an exact reviewed version.

3. Generate and enforce cryptographic hashes, for example:

   bash

   python -m pip install --require-hashes -r scripts/requirements.txt
   

4. Use a lock-generation workflow such as pip-tools to produce reproducible dependency sets for each supported Python version and platform.

5. Configure an explicitly trusted package index or an internally controlled artifact repository rather than relying on arbitrary local pip configuration.

6. Install dependencies in an isolated virtual environment with minimal filesystem, credential, and network access.

7. Scan locked dependencies for known vulnerabilities and review updates before changing pinned versions or hashes.

8. Remove the command referencing scripts/requirements.txt until that file is actually shipped with the package.

9. Include the referenced application scripts in the package so their imports and dependency usage can be audited before execution.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill performs actions that create, overwrite, split, and export files, but it does not clearly warn users about these side effects. Without explicit disclosure and confirmation, an agent may modify or proliferate files unexpectedly, risking data loss, confusion, or accidental disclosure through generated outputs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file states the free version exposes 8 scripts, but elsewhere implies those scripts cover column selection while the limitations section explicitly says column selection is unavailable. This creates ambiguous execution boundaries, making it easier for an agent to overclaim functionality or attempt unsupported file transformations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documentation is internally inconsistent about whether column selection/renaming is supported in the free edition. Such contradictions can cause the agent or user to invoke non-existent or unintended operations, increasing the chance of incorrect file handling or fallback behavior outside the advertised scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The scope keywords include broad generic phrases such as file handling, content extraction, and other loosely bounded terms. Overbroad invocation criteria can cause the skill to activate for tasks beyond Excel processing, leading to unintended exec-based file operations in unrelated contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document states that the skill has been fully localized for Chinese usage scenarios, and all examples, parameter names, and operational guidance are presented only in Chinese. There is no indication that users can opt into another language or that the locale restriction is intentionally limited to a justified region-specific deployment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill is presented as local Excel processing, but the error-handling section introduces network diagnostics like ping and firewall/proxy checks. This scope drift can prompt unnecessary network-related actions in environments where the user only expected local file manipulation, violating least surprise and potentially expanding operational exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.