Security audit

Excel表格处理工具

Security checks for vulnerabilities and agentic risk

Overview

This Excel skill is not clearly limited to spreadsheet work and asks for command execution, write access, API-key handling, and broad file-processing authority without tight scoping.

Review before installing. Use this only on approved spreadsheet files or copies, and do not grant command execution or API credentials unless the publisher narrows the scope, names the external service, defines exactly what data leaves the machine, and documents safe command limits.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The manifest advertises a narrowly scoped Excel/XLSX skill, but the body broadens it to generic file processing, API usage, and command execution. This scope mismatch is dangerous because users or orchestrators may grant the skill trust and permissions appropriate for spreadsheet handling while the documentation normalizes far more powerful behaviors.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The skill states it is not for non-XLSX formats, yet elsewhere claims support for multiple file formats. Conflicting scope claims can cause unsafe invocation, including use on unintended file types and overbroad trust in file-handling capabilities.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: Documenting API keys and external API dependence for a nominally local XLSX-processing skill introduces unnecessary secret handling and network access. That expands the attack surface by enabling credential exposure, unauthorized outbound requests, or covert data exfiltration unrelated to spreadsheet editing.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: System command execution is a high-risk capability that is unrelated to normal Excel/XLSX manipulation as described. In this context, advertising exec as a feature can enable arbitrary local actions, file tampering, environment inspection, or execution chains far beyond the expected spreadsheet workflow.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: Overly broad invocation guidance makes the skill eligible for many generic file-processing tasks outside its declared purpose. In an agent ecosystem, that increases the chance the skill is auto-selected in contexts where its exec, write, or API-related behaviors could be misused.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill describes editing files without a clear warning that it may modify workbooks and has access to powerful tools, including exec elsewhere in the document. Lack of upfront safety disclosure can lead users or agents to invoke it on sensitive files without informed consent or appropriate safeguards.

Static analysis

No suspicious patterns detected.