openclawkit-excel

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:29 AM UTC
• Version: 1.0.1

Overview

This is a local Excel utility whose file read/write behavior matches its stated purpose, with some quality and caution notes but no evidence of hidden or malicious behavior.

Before installing, use a dedicated environment, consider pinning dependency versions, and verify input and output paths because the tool can create or overwrite spreadsheet files. Keep backups of important workbooks and note that the interface is Chinese-only and some documented examples appear inaccurate or incomplete.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39
• Finding: Unpinned Third-Party Dependencies Create Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:39` **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash pip install pandas openpyxl ``` ### Technical Analysis The documented installation command retrieves mutable, unconstrained versions of `pandas` and `openpyxl`. It does not specify reviewed versions, verify package hashes, or use a lock file. Consequently, different installations can resolve to different dependency versions. If a dependency release or its distribution account is compromised, package installation, build hooks, or subsequent imports could execute attacker-controlled code with the privileges of the user running the skill. The packages are correctly named and obtained through pip's configured index, so there is no evidence that the project intentionally references a malicious or typosquatted package. The risk arises from the absence of version and integrity controls. ### Attack Path 1. An attacker compromises a dependency's publishing account, release process, or configured Python package index. 2. The attacker publishes a malicious release under the legitimate dependency name. 3. A user follows the documented unconstrained installation command. 4. Pip resolves and installs the malicious release because no version or hash restriction rejects it. 5. Malicious package code executes during installation, build processing, or import by the skill. ### Impact Assessment A compromised dependency could execute arbitrary code with the privileges of the user or service account installing and running the skill. Depending on that account's permissions, this could expose accessible files and environment variables, alter generated spreadsheets, perform network activity, or compromise the local execution environment. This project itself does not request elevated privileges, so the impact remains bounded by the invoking account's permissions.
• Remediation: ## Remediation Suggestions 1. Add a dependency lock or requirements file containing reviewed, exact versions, for example: ```text pandas==REVIEWED_VERSION openpyxl==REVIEWED_VERSION ``` 2. Generate and verify package hashes, then install with pip's `--require-hashes` option. 3. Configure installation to use an explicitly trusted package index. 4. Regularly scan locked dependencies for known vulnerabilities and update them through a controlled review process. 5. Run dependency installation and the skill under a dedicated, least-privileged environment rather than an administrative account.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/openclawkit_excel.py:467
• Finding: User-Controlled Regular Expression Can Cause Excessive Resource Consumption## Vulnerability Details **File Location**: `scripts/openclawkit_excel.py:467-469` **Vulnerability Type**: Regular-expression denial of service **Risk Level**: Low **Vulnerable Code Snippet**: ```python # Convert the DataFrame to strings and search it if case_sensitive: mask = df.astype(str).apply(lambda x: x.str.contains(search_term, na=False)) else: mask = df.astype(str).apply(lambda x: x.str.contains(search_term, case=False, na=False)) ``` ### Technical Analysis `pandas.Series.str.contains()` interprets its pattern as a regular expression by default because `regex=True` is implicit. The `search_term` argument is passed directly to this operation without escaping, validation, a length limit, or an execution timeout. If an untrusted caller controls `search_term`, it can supply an invalid expression that causes the search to fail or a pathological expression involving nested or ambiguous quantifiers. Such a pattern may cause excessive backtracking when evaluated against suitable cell contents. The pattern is evaluated across every converted cell in the worksheet, which can amplify CPU and memory consumption for large spreadsheets. ### Attack Path 1. An application exposes `ExcelToolkit.search_data()` to a user or otherwise passes an untrusted search term to it. 2. The attacker supplies a malformed or computationally expensive regular expression. 3. The method converts the complete worksheet DataFrame to strings. 4. `str.contains()` repeatedly evaluates the attacker's expression across worksheet cells. 5. The operation raises an exception or consumes excessive processing time, reducing availability of the process or worker. This attack path requires an integration in which an untrusted party can control the search term; the supplied command-line interface does not currently expose this method. ### Impact Assessment Successful exploitation can cause local process failure, high CPU usage, increased mem ...[truncated 301 chars]
• Remediation: ## Remediation Suggestions Treat search terms as literal text unless regular-expression behavior is an explicit requirement: ```python if case_sensitive: mask = df.astype(str).apply( lambda x: x.str.contains(search_term, regex=False, na=False) ) else: normalized_term = search_term.casefold() mask = df.astype(str).apply( lambda x: x.str.casefold().str.contains( normalized_term, regex=False, na=False ) ) ``` If regular expressions must be supported: 1. Make regex mode an explicit opt-in option. 2. Limit pattern length and reject known high-risk constructs. 3. Compile the expression before processing the worksheet and return a controlled validation error for malformed patterns. 4. Limit worksheet size and search execution time. 5. Run searches in an isolated worker with CPU and memory limits when terms can originate from untrusted users.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill description explicitly advertises creating and writing Excel files, which can affect user data, but it does not include any warning about overwriting existing files, modifying workbook contents, or recommending backups. For a markdown skill description, this is a missing user warning about data-affecting behavior.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The command examples show merge, convert, clean, and report generation operations that produce new spreadsheet outputs, but the surrounding documentation provides no warning about checking input/output paths, avoiding accidental overwrite, or validating transformed data. This omits user-facing caution for operations that can impact user data handling.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: This Python code presents its command descriptions, help text, status messages, and errors exclusively in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a finding because users are not offered any locale or language selection.

Static analysis

No suspicious patterns detected.