Xlsx Handler Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:23 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent local XLSX helper, but it asks for write and exec authority while using broad activation language and overstating validation guarantees for workbook edits.

Review this skill before installing if it may touch important spreadsheets. Use it only for explicit Excel/XLSX tasks, install dependencies in an isolated environment with pinned versions where possible, and direct the agent to write modified workbooks to a new output file unless you intentionally approve overwriting.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:274

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 274–275
Vulnerability Type: Supply-chain risk from unpinned dependencies
Risk Level: Medium

Complete Code Snippet:

markdown

| openpyxl | Python library | Required | `pip install openpyxl` |
| pandas | Python library | Optional | `pip install pandas` |

Technical Analysis

The Skill directs the agent to install openpyxl and optionally pandas without pinning reviewed versions, validating package hashes, supplying a lockfile, or explicitly restricting resolution to a trusted package index. Consequently, each installation can resolve mutable registry content that may differ from the version assessed during development or audit.

Package installation and later imports can execute third-party code with the privileges of the agent process. If an upstream release or package-distribution account is compromised, an unsafe future version could enter the environment without any change to this repository. The evidence does not establish that either named package is currently malicious; the finding concerns the unsafe dependency-resolution procedure.

Attack Path

1. A user invokes the Skill in an environment where the required packages are unavailable.
2. The agent follows SKILL.md and runs pip install openpyxl or pip install pandas.
3. pip resolves the latest matching package and transitive dependencies from its configured registry because no versions or hashes are specified.
4. If a resolved release or registry response has been compromised, malicious package code is installed.
5. Installation hooks or a subsequent Python import execute that code under the agent process's account.

This path requires compromise or unsafe configuration of the external package supply chain; the audited project does not itself retrieve a known malicious payload.

Impact Assessment

A compromised dependency could obtain the same privileges as the us ...[truncated 515 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each direct dependency to a specifically reviewed version, such as openpyxl==<reviewed-version>.
2. Pin transitive dependencies through a generated lockfile rather than relying only on top-level constraints.
3. Require package hashes, for example with a requirements file installed using pip install --require-hashes -r requirements.txt.
4. Explicitly use an approved package index or an internally controlled mirror and disable unintended extra indexes.
5. Install dependencies in an isolated virtual environment or restricted container under a non-privileged account.
6. Scan locked dependencies for known vulnerabilities and review updates before changing pinned versions.
7. Prevent dependency installation during normal Skill execution where possible; prepare and verify the runtime environment in advance.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill claims it will perform pre-delivery validation and ensure 'zero formula errors', but the provided logic only checks a short hard-coded list of visible Excel error literals and does not actually evaluate formula correctness, dependency integrity, broken references outside those strings, or recalculation state. This can create a false sense of safety that may cause users to trust corrupted or incomplete workbook outputs in financial or operational workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation language is very broad ('file processing', 'document conversion', 'format conversion', 'content extraction'), which can cause the skill to trigger for many loosely related tasks outside narrowly intended XLSX operations. In an agentic environment with read/write/exec tools, overbroad routing increases the chance of unnecessary code generation or file modification on unrelated user requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill describes create/modify/save/export operations for local workbook files without prominently warning that these actions can overwrite existing files or alter workbook contents irreversibly. In a skill with write and exec capabilities, missing overwrite and backup guidance raises the risk of accidental data loss, especially when agents act autonomously on user-supplied paths.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill publishes an expansive keyword coverage list with minimal guardrails, effectively encouraging broad matching across many generic data-handling phrases. In context, this makes the skill more dangerous because it advertises exec-backed capabilities and workbook modification behavior, so accidental activation can lead to unintended local file access or changes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

Lines L277-L280 state the skill is local-only and '不涉及网络调用与外部端点'. Yet L272 says 'LLM API' is required, which implies an external service dependency for operation; even if provided by the agent platform, this contradicts the absolute no-network wording.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.