Excel工具(免费版)

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.1

Overview

This is a straightforward Excel-processing skill, with expected but nonzero risks from writing spreadsheet outputs, running generated Python, and installing common unpinned dependencies.

Before installing, treat this as a local-file automation helper: use copies of important spreadsheets, choose explicit output filenames and directories, review generated Python before it runs, and install dependencies in an isolated environment with pinned versions where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:97

Finding

Unpinned Third-Party Dependencies Installed at Runtime

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 97
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

markdown

1. Install dependencies: `pip install openpyxl pandas`

Technical Analysis

The Skill instructs the Agent to install openpyxl and pandas without specifying reviewed versions, package hashes, a lockfile, or a trusted package index. Consequently, dependency resolution can produce different software across executions and implicitly trusts the Agent environment's configured Python package source.

If a future dependency release or configured package index is compromised, attacker-controlled code could run during package installation or when the installed package is imported. The project does not itself contain a malicious dependency or explicitly select a known malicious package; the vulnerability is the unsafe and non-reproducible installation process.

Attack Path

1. A user invokes the Skill in an environment where the required packages are unavailable.
2. The Agent follows the documented setup instruction and runs pip install openpyxl pandas.
3. pip resolves packages and transitive dependencies through the environment's configured package index without validating project-approved versions or hashes.
4. A compromised package release, transitive dependency, or hostile configured index supplies attacker-controlled package content.
5. Malicious code executes during installation or a subsequent Python import with the privileges of the Agent process.

Impact Assessment

Successful exploitation could provide code execution with the permissions of the Agent process. Depending on its environment, this may expose Excel documents, workspace files, environment variables, credentials available to the process, and writable project resources. The impact is constrained by the Agent's operating-system permissions and any sandboxing or network restri ...[truncated 169 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct and transitive dependency to a reviewed version in a lockfile.
2. Record and enforce cryptographic hashes for all downloaded distributions:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Configure pip to use an explicitly trusted package index rather than inheriting an unknown environment configuration.
4. Install dependencies in an isolated virtual environment or restricted container using a non-privileged account.
5. Generate dependencies in a controlled build process and scan them for known vulnerabilities before deployment.
6. Periodically review and deliberately update pinned versions rather than resolving the latest versions at runtime.
7. Avoid granting the dependency-installation process access to credentials or sensitive user documents.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly supports creating, exporting, and saving Excel files but does not instruct the agent to obtain confirmation before overwriting existing files or modifying user-provided data. In an agent context with write and exec capabilities, this omission can lead to accidental data loss or silent alteration of important spreadsheets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill tells the agent to generate Python scripts and execute them, yet provides no guardrails on what code may be produced or how file paths, dependencies, and inputs should be constrained. Because the skill declares exec capability and processes user-provided files, prompt-influenced code generation can expand into arbitrary code execution, unsafe file access, or destructive local actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill states that processed files are stored in a user-specified directory or a default workspace subdirectory, but does not clearly warn users where sensitive spreadsheet contents will be written or retained. This can expose confidential business data through unintended persistence, discoverability by other workspace processes, or confusion about where outputs landed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.