Security audit
Security checks for vulnerabilities and agentic risk
This Excel helper is mostly local file-processing guidance, but it needs review because it mixes in vague API-key/network instructions and file-changing workflows without tight user control.
Review this before installing if you expect a local-only Excel helper. Use it only on files you explicitly provide, prefer saving to new output files, and do not provide API keys or credentials unless the publisher clarifies a specific optional integration and why it is needed.
The document gives contradictory guidance about API key requirements, first stating no extra API key is needed and later stating some functions require API keys. In a security-sensitive agent context, this ambiguity can cause users or downstream agents to request, expose, or mishandle credentials unexpectedly.
The skill is presented as a local Excel-processing tool, but later sections introduce API connection, credential setup, interface calls, and network troubleshooting. This broadens the operational scope beyond user expectations and can lead an agent to perform external communication or credential handling in contexts where only local file processing was intended.
The invocation guidance is extremely broad and effectively says to call the skill whenever needed, without defining narrow trigger conditions or safety boundaries. In an agent setting, vague activation criteria increase the chance of over-invocation, unintended file handling, and use on inputs outside the intended Excel-processing scope.
The skill describes writing, modifying, deleting, renaming, protecting, and saving workbook content, but it does not prominently warn that executing these flows will alter or create files. In an agent environment, hidden side effects on user files can cause data loss, overwrites, or unauthorized changes if the model acts without explicit confirmation.
No suspicious patterns detected.
