Security audit

Excel工作室

Security checks across malware telemetry and agentic risk

Overview

This Excel skill is mostly a Markdown-only guide, but it asks for broad read/write/exec authority and external API use without clearly scoping what commands, files, or services are involved.

Review this before installing if you plan to use it with sensitive spreadsheets or an agent that has shell access. Limit it to trusted workspaces, avoid giving it secrets unless the API destination is known, and require confirmation before any command execution, file overwrite, or external upload.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill is presented as an Excel spreadsheet generator, but the documented outputs expand into generic content generation, scoring, and broader processing behavior. This scope expansion increases the chance that an agent will apply the skill to unrelated tasks and grant it broader data and execution access than users would reasonably expect.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: Advertising command execution in a skill whose stated purpose is Excel generation creates unjustified authority expansion. In an agent environment with exec/write tools, this can lead to unnecessary shell access, filesystem changes, or execution of attacker-influenced commands under the guise of spreadsheet work.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The skill advertises external API/service integration beyond what users would expect from a local Excel generator. This broadens the trust boundary and can expose workbook contents or sensitive user data to external services without clear necessity or consent.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The file alternates between describing the skill as pure Markdown guidance and as an executable MD+execute() skill. This ambiguity is dangerous because operators may assume the skill is passive documentation when it can actually trigger command execution, leading to underestimation of risk and weaker review controls.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill mentions file handling, API integration, and command execution but does not clearly warn that local files or system state may be modified. This can mislead users into invoking the skill without understanding that it may write files, alter data, or perform side-effecting actions on the host environment.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.