ClawHub
Back to skill

Security audit

Excel Studio

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Excel-generation helper with some quality and input-safety caveats, but no evidence of hidden access, exfiltration, persistence, or destructive behavior.

Install this only in an environment where mutable pip dependencies are acceptable, and be careful when generating spreadsheets from untrusted data: values beginning with formula characters should be treated as text unless you intentionally want formulas. Expect XLSX output from the provided workflow despite broader format claims.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:7
Finding

Unpinned Third-Party Dependencies Without Integrity Verification

Content
View full analysis
Remediation
View remediation
xlwt== ``` 2. Generate and verify cryptographic hashes for all distributions, then install with pip's `--require-hashes` option. 3. Store dependencies in a dedicated lock file instead of embedding a mutable installation command in metadata. 4. Use a trusted package index or an internally controlled artifact repository. 5. Prefer pre-reviewed binary wheels where appropriate and disable unnecessary source builds. 6. Run dependency installation and spreadsheet generation in a restricted environment with minimal filesystem and network permissions. 7. Add automated dependency scanning and a controlled update process so pinned versions can receive reviewed security updates. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:113
Finding

Spreadsheet Formula Injection Through Untrusted Cell Values

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest and surrounding documentation state that the skill supports .xlsx, .xls, and .csv formats, and later notes mention xlwt and csv usage. However, the only executable script shown imports openpyxl, constructs an openpyxl Workbook, and saves a hard-coded 'sales_report.xlsx' file, with no .xls or .csv generation path present.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger condition "做数据分析" / "Create data analysis" is a broad, generic request that overlaps with many common user intents not necessarily requiring this specific Excel skill. The file does not provide exclusion conditions or scope limits to distinguish when general analysis should invoke this skill versus another tool or workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

Although the skill claims multi-language support, the actual requirement-gathering prompt is written only in Chinese, which can force a specific language experience on users who did not opt in. This is a natural-language locale policy concern because the operational instructions do not clearly offer equivalent language selection before proceeding.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium
Category
Output Handling
Confidence
78% confidence
Finding

The auto_column_width routine iterates every cell in every column and converts each value to a string to compute width, with no worksheet size limits. An attacker supplying a very large spreadsheet or extremely long cell contents could cause excessive CPU and memory use, resulting in denial of service or severe slowdown during file generation.

Content

Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.

md
"""Auto-adjust column widths"""
        ws = self.get_sheet(sheet_name)
        for col in ws.columns:
            max_length = 0
            column = col[0].column_letter
            for cell in col:
                try:

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 12)May include surrounding context.

text
permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The feature list and chart table advertise scatter chart support, but the add_chart implementation only maps 'bar', 'line', and 'pie' to concrete chart objects. Any unsupported type falls back to BarChart(), so requesting 'scatter' would not produce the documented behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.