Security audit
Security checks for vulnerabilities and agentic risk
This spreadsheet skill is not clearly malicious, but it asks for broad command-execution and vague API/network authority without enough scoping for a spreadsheet tool.
Review before installing. Use only with spreadsheets you trust, avoid sensitive data unless you understand where it may be sent or processed, and require explicit approval before any command execution or API/network use. The artifact does not show destructive or exfiltration code, but its requested authority is broader than its spreadsheet purpose explains.
The skill is presented as a spreadsheet-processing tool, but its manifest and documentation expand into generic API, networking, and execution workflows unrelated to that purpose. This scope creep weakens least-privilege expectations and can mislead an agent into granting or using broader capabilities than a user would reasonably expect for spreadsheet handling.
The manifest declares exec capability even though the stated purpose is ordinary spreadsheet processing. Allowing command execution in a file-handling skill materially increases the risk of arbitrary local command invocation, file tampering, or chaining user-controlled spreadsheet content into shell operations.
The documentation introduces LLM API and external data-source/network dependencies without clearly tying them to spreadsheet-specific needs. This broadens the attack surface by enabling unnecessary outbound communication, possible data exfiltration, and trust in unspecified remote content.
The file claims command execution is restricted to a whitelist, but there is no enforceable implementation or policy present in the skill definition. Security assertions without technical enforcement can create false trust and lead reviewers or agents to approve a risky capability that remains effectively unconstrained.
The trigger language is extremely broad, covering nearly any task where a spreadsheet file is involved. Over-broad activation can cause this skill to be invoked for routine requests unnecessarily, increasing exposure to its risky exec and network-related capabilities in contexts where simpler, safer handling would suffice.
The automatic trigger condition states the skill activates whenever the user needs related operations, but it does not define what qualifies or what guardrails apply. In a skill with execution and network-adjacent behavior, ambiguous auto-invocation increases the chance of unintended use on untrusted files or sensitive data.
No suspicious patterns detected.
