ClawHub
Back to skill

Security audit

Ws Excel Tool Free

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Excel-processing helper that uses local Python execution and file writes for its stated purpose, with no evidence of hidden persistence, exfiltration, or deceptive behavior.

Install only if you are comfortable letting the agent run local Python code against Excel files you provide. Ask it to show the resolved output path first and to create new filenames rather than overwrite originals unless you explicitly request an overwrite.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly supports writing, exporting, and saving Excel outputs but does not clearly warn users that existing files may be modified or overwritten. In a file-processing skill, silent write behavior can cause data loss, accidental corruption of user workbooks, or writing sensitive derived data into unintended locations.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill instructs the agent to generate Python scripts and execute them via exec without a strong warning or safety boundary. In this context, generated code execution is dangerous because user-controlled prompts, file paths, or workbook content could influence script generation and lead to arbitrary command execution, unintended file access, or destructive local actions.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
Documenting export/save behavior without stating where outputs go or whether they can overwrite existing files creates a meaningful safety risk. Users may unintentionally expose processed data to shared directories or lose original documents if the agent saves back to the same path without confirmation.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.