ClawHub
Back to skill

Security audit

Xlsx Handler Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a local XLSX workbook helper with proportionate read, write, and Python execution guidance, though users should be careful because it can create or modify spreadsheet files.

Install only if you want an agent to inspect or edit local XLSX files. Before write operations, ask it to save to a new filename, avoid overwriting originals, and confirm the target workbook and sheet.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill description uses very broad trigger language such as generic file handling, document conversion, format conversion, and content extraction, which can cause the agent to invoke this skill for many unrelated requests. Overbroad activation increases the chance of unintended file access or execution paths, especially because the skill also declares exec capability.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The capability coverage section enumerates a long list of broad keywords rather than bounded conditions for when the skill should activate. This can make routing overly permissive and cause the skill to be selected outside its safe operational scope, particularly in environments that match on keywords.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill describes write and save behavior for local workbooks but does not prominently warn that these actions create persistent file modifications. In an agent setting, missing user-facing warnings can lead to accidental overwrites, corruption of important spreadsheets, or modification of the wrong file.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The example workflow performs template loading and saves an output workbook without a clear warning about persistent changes or safeguards against overwriting existing files. Users or agents may reuse the pattern directly and unintentionally alter or replace important spreadsheets on disk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.