Security audit

xlsx

Security checks across malware telemetry and agentic risk

Overview

This spreadsheet skill is not clearly malicious, but it asks for broad command-execution and vague API/network authority without enough scoping for a spreadsheet tool.

Review before installing. Use only with spreadsheets you trust, avoid sensitive data unless you understand where it may be sent or processed, and require explicit approval before any command execution or API/network use. The artifact does not show destructive or exfiltration code, but its requested authority is broader than its spreadsheet purpose explains.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is presented as a spreadsheet-processing tool, but its manifest and documentation expand into generic API, networking, and execution workflows unrelated to that purpose. This scope creep weakens least-privilege expectations and can mislead an agent into granting or using broader capabilities than a user would reasonably expect for spreadsheet handling.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The manifest declares exec capability even though the stated purpose is ordinary spreadsheet processing. Allowing command execution in a file-handling skill materially increases the risk of arbitrary local command invocation, file tampering, or chaining user-controlled spreadsheet content into shell operations.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The documentation introduces LLM API and external data-source/network dependencies without clearly tying them to spreadsheet-specific needs. This broadens the attack surface by enabling unnecessary outbound communication, possible data exfiltration, and trust in unspecified remote content.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The file claims command execution is restricted to a whitelist, but there is no enforceable implementation or policy present in the skill definition. Security assertions without technical enforcement can create false trust and lead reviewers or agents to approve a risky capability that remains effectively unconstrained.

Vague Triggers

High

Confidence: 90% confidence
Finding: The trigger language is extremely broad, covering nearly any task where a spreadsheet file is involved. Over-broad activation can cause this skill to be invoked for routine requests unnecessarily, increasing exposure to its risky exec and network-related capabilities in contexts where simpler, safer handling would suffice.

Vague Triggers

High

Confidence: 91% confidence
Finding: The automatic trigger condition states the skill activates whenever the user needs related operations, but it does not define what qualifies or what guardrails apply. In a skill with execution and network-adjacent behavior, ambiguous auto-invocation increases the chance of unintended use on untrusted files or sensitive data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.