tableau

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:44 AM UTC
• Version: 0.1.0

Overview

This appears to be a legitimate Tableau configuration helper, but it needs Review because it can automatically run and install an unpinned command-line tool.

Review before installing. Use it in a project sandbox, expect it to create conversion files and run tableauc, and require a preinstalled or pinned tableauc version instead of allowing automatic go install @latest. Avoid running it in directories containing unrelated sensitive files or credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:91

Finding

Unpinned Third-Party Executable Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:91-93
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

markdown

### Locating `tableauc`

1. Try `tableauc --version` first
2. If not found: `go install github.com/tableauio/tableau/cmd/tableauc@latest`

Technical Analysis

The Skill instructs the Agent to download, compile, and install the mutable @latest version of a third-party Go module when tableauc is unavailable. Because @latest does not identify an immutable, previously reviewed release, the effective dependency and its transitive dependency graph can change after this Skill has been audited.

This creates a supply-chain risk: compromise of the upstream repository, module publishing process, release credentials, or a future dependency version could cause the Agent to build and install hostile code. The referenced GitHub organization is consistent with the Skill's declared project, so there is no evidence of dependency confusion, typosquatting, or intentional malicious behavior. The issue is the use of a mutable, unverified dependency version.

Attack Path

1. An attacker compromises the upstream module, release process, maintainer credentials, or a transitive dependency selected by the latest release.
2. The target environment does not already contain the tableauc executable.
3. The Agent follows the instruction in SKILL.md and executes:

   bash

   go install github.com/tableauio/tableau/cmd/tableauc@latest
   

4. Go resolves and downloads the current mutable module version and its dependencies.
5. The downloaded source is compiled, and the resulting executable is installed under the Agent user's Go binary path.
6. The compromised executable subsequently runs during spreadsheet conversion and operates with the Agent user's permissions.

Exploitation depends on an upstream or dependency compromise and on the installation i ...[truncated 788 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with a reviewed, immutable semantic version:

   bash

   go install github.com/tableauio/tableau/cmd/tableauc@vX.Y.Z
   

2. Record the approved version in the Skill and update it only through a deliberate review process.
3. Require explicit user approval before downloading or installing any missing executable.
4. Prefer a preinstalled, trusted tableauc binary in a controlled environment rather than performing installation during normal Skill execution.
5. Document verification of the module source and checksum through the Go checksum database or an organization-controlled checksum policy.
6. Pin and review relevant transitive dependencies where reproducible build controls permit.
7. Run the converter in a sandbox with minimal filesystem access, restricted network access, no unnecessary credentials, and no administrative privileges.
8. If installation fails or the approved version is unavailable, stop and report the condition instead of falling back to another mutable version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (34)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/xml/index.md (reported line 11)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
<@TABLEAU>
    <Item Sheet="Sheet1" Alias="ItemConf" OrderedMap="true" Index="(ID,Type)@Item" />
    <Item Sheet="Sheet2" Alias="FruitConf" Sep="," Subsep=":" FieldPresence="true" />

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/xml/index.md (reported line 67)May include surrounding context.

For struct maps and lists, use attributes on elements:

xml

<!--
<@TABLEAU>
    <Item Sheet="MapConf" />
</@TABLEAU>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/xml/index.md (reported line 566)May include surrounding context.

Use @type="{.Target}" without form for cross-element union fields:

xml

<!--
<ItemConf>
    <Target @type="{.Target}" />
</ItemConf>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/xml/index.md (reported line 580)May include surrounding context.

Predefined union list

xml

<!--
<ItemConf>
    <Target @type="[.Target]" />
</ItemConf>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/xml/index.md (reported line 597)May include surrounding context.

Define the union type inline using {.Target}enum<.Target.Type> on the type column:

xml

<!--
<XMLUnionConf>
    <Union Type="[.Target]enum&lt;.Target.Type&gt;" Field1="union" Field2="union" />
</XMLUnionConf>

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill mandates creating and using temp/ automatically, including creating the directory if it does not exist, without first warning the user about filesystem side effects. Silent writes are risky because they normalize state-changing behavior and can overwrite expectations in shared or sensitive working directories.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow requires writing or modifying input files and config.yaml as a default behavior, including copying template content, even when the user may only be asking conceptual questions. This creates unauthorized local state changes and can clobber existing configuration files or produce misleading outputs without the user's informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill directs the agent to run external CLI commands (tableauc) and potentially perform network-backed installation, but does not require a clear user-facing warning or approval for subprocess execution. This is dangerous because command execution expands the attack surface from text assistance into code/tool execution, with possible file, environment, and network side effects.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs the agent to install tableauc from the network via go install if the binary is missing. Even if intended to improve usability, automatic dependency installation introduces supply-chain and unexpected network-execution risk, especially when triggered from untrusted user prompts or environments with sensitive credentials.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · evals/trigger_eval.json (reported line 59)May include surrounding context.

json

"should_trigger": false
    },
    {
        "query": "how do i set up a github actions workflow to automatically run my unit tests whenever someone opens a pull request against the main branch?",
        "should_trigger": false
    },
    {

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The positive example at lines 91–92 is broad enough to blur the boundary between the narrowly scoped Tableau config-conversion skill and more generic spreadsheet/schema tooling. In a trigger-eval dataset, this can train or validate overbroad activation behavior, causing the agent to invoke the skill for loosely related requests outside its intended domain.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/excel/enum.md (reported line 35)May include surrounding context.

md

> ⚠️ **Column order is critical**: `Number` (optional) is col 1 when present, `Name` follows, `Alias` is last. Never put `Name` before `Number`.

| Column   | Required | Description                                                                                                                                                                     |
| -------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Number` | No       | Integer value; auto-increments from 1 if omitted. **When present, it is always the first column.**                                                                              |
| `Name`   | Yes      | Proto enum value name, e.g. `FRUIT_TYPE_APPLE` (UPPER_SNAKE_CASE)                                                                                                               |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/excel/enum.md (reported line 38)May include surrounding context.

md

| Column   | Required | Description                                                                                                                                                                     |
| -------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Number` | No       | Integer value; auto-increments from 1 if omitted. **When present, it is always the first column.**                                                                              |
| `Name`   | Yes      | Proto enum value name, e.g. `FRUIT_TYPE_APPLE` (UPPER_SNAKE_CASE)                                                                                                               |
| `Alias`  | No       | Human-readable short name → stored as `(tableau.evalue).name` in proto. Can be English (`Apple`) or Chinese (`苹果`). Use the **exact alias text** from the user's description. |

### Parsing Number from user descriptions

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The text says aliases can be English or Chinese and then requires using the exact alias text from the user's description. This imposes the user's language choice directly and can create a language/locale policy issue because the skill does not mention offering an explicit language or locale choice where output language may matter.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This instruction explicitly requires retaining the user's note text and says never to substitute English descriptions. That is a language/locale constraint expressed in natural language, but the document does not present it as an opt-in choice or justify it as a region-specific requirement.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/excel/field-property.md (reported line 109)May include surrounding context.

md

Specifies the cell data format for incell struct fields.

| Value       | Description                                                                                  |
| ----------- | -------------------------------------------------------------------------------------------- |
| `FORM_TEXT` | Protobuf [text format](https://developers.google.com/protocol-buffers/docs/text-format-spec) |
| `FORM_JSON` | Protobuf [JSON format](https://developers.google.com/protocol-buffers/docs/proto3#json)      |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/excel/index.md (reported line 23)May include surrounding context.

md

### Metasheet columns

| Column         | Description                                                                                                                                    |
| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| `Sheet`        | Worksheet name. Use `#` as a special row for workbook-level options.                                                                           |
| `Alias`        | Alias for the sheet (becomes the proto message name / proto filename for `#` row)                                                              |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/excel/index.md (reported line 28)May include surrounding context.

md

| `Sheet`        | Worksheet name. Use `#` as a special row for workbook-level options.                                                                           |
| `Alias`        | Alias for the sheet (becomes the proto message name / proto filename for `#` row)                                                              |
| `Mode`         | Sheet mode: `MODE_ENUM_TYPE`, `MODE_ENUM_TYPE_MULTI`, `MODE_STRUCT_TYPE`, `MODE_STRUCT_TYPE_MULTI`, `MODE_UNION_TYPE`, `MODE_UNION_TYPE_MULTI` |
| `OrderedMap`   | `true` to preserve insertion order of map keys                                                                                                 |
| `Index`        | Composite index, e.g. `(Type,Rarity)@TRIndex`                                                                                                  |
| `OrderedIndex` | Ordered index, e.g. `Level@LevelIndex`                                                                                                         |
| `Nested`       | `true` to enable dot-separated column name hierarchy                                                                                           |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/excel/index.md (reported line 29)May include surrounding context.

md

| `Alias`        | Alias for the sheet (becomes the proto message name / proto filename for `#` row)                                                              |
| `Mode`         | Sheet mode: `MODE_ENUM_TYPE`, `MODE_ENUM_TYPE_MULTI`, `MODE_STRUCT_TYPE`, `MODE_STRUCT_TYPE_MULTI`, `MODE_UNION_TYPE`, `MODE_UNION_TYPE_MULTI` |
| `OrderedMap`   | `true` to preserve insertion order of map keys                                                                                                 |
| `Index`        | Composite index, e.g. `(Type,Rarity)@TRIndex`                                                                                                  |
| `OrderedIndex` | Ordered index, e.g. `Level@LevelIndex`                                                                                                         |
| `Nested`       | `true` to enable dot-separated column name hierarchy                                                                                           |
| `Sep`          | Sheet-level separator for incell lists/maps (default `,`)                                                                                      |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/excel/index.md (reported line 30)May include surrounding context.

md

| `Mode`         | Sheet mode: `MODE_ENUM_TYPE`, `MODE_ENUM_TYPE_MULTI`, `MODE_STRUCT_TYPE`, `MODE_STRUCT_TYPE_MULTI`, `MODE_UNION_TYPE`, `MODE_UNION_TYPE_MULTI` |
| `OrderedMap`   | `true` to preserve insertion order of map keys                                                                                                 |
| `Index`        | Composite index, e.g. `(Type,Rarity)@TRIndex`                                                                                                  |
| `OrderedIndex` | Ordered index, e.g. `Level@LevelIndex`                                                                                                         |
| `Nested`       | `true` to enable dot-separated column name hierarchy                                                                                           |
| `Sep`          | Sheet-level separator for incell lists/maps (default `,`)                                                                                      |
| `Subsep`       | Sheet-level sub-separator for incell map key-value pairs (default `:`)                                                                         |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/excel/index.md (reported line 31)May include surrounding context.

md

| `OrderedMap`   | `true` to preserve insertion order of map keys                                                                                                 |
| `Index`        | Composite index, e.g. `(Type,Rarity)@TRIndex`                                                                                                  |
| `OrderedIndex` | Ordered index, e.g. `Level@LevelIndex`                                                                                                         |
| `Nested`       | `true` to enable dot-separated column name hierarchy                                                                                           |
| `Sep`          | Sheet-level separator for incell lists/maps (default `,`)                                                                                      |
| `Subsep`       | Sheet-level sub-separator for incell map key-value pairs (default `:`)                                                                         |
| `Patch`        | Patch mode for merging data                                                                                                                    |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/excel/index.md (reported line 32)May include surrounding context.

md

| `Index`        | Composite index, e.g. `(Type,Rarity)@TRIndex`                                                                                                  |
| `OrderedIndex` | Ordered index, e.g. `Level@LevelIndex`                                                                                                         |
| `Nested`       | `true` to enable dot-separated column name hierarchy                                                                                           |
| `Sep`          | Sheet-level separator for incell lists/maps (default `,`)                                                                                      |
| `Subsep`       | Sheet-level sub-separator for incell map key-value pairs (default `:`)                                                                         |
| `Patch`        | Patch mode for merging data                                                                                                                    |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/excel/index.md (reported line 34)May include surrounding context.

md

| `Nested`       | `true` to enable dot-separated column name hierarchy                                                                                           |
| `Sep`          | Sheet-level separator for incell lists/maps (default `,`)                                                                                      |
| `Subsep`       | Sheet-level sub-separator for incell map key-value pairs (default `:`)                                                                         |
| `Patch`        | Patch mode for merging data                                                                                                                    |

### Example metasheet

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/excel/index.md (reported line 167)May include surrounding context.

md

**Key fill rules based on auto-deduced uniqueness:**

| Key column          | Value type contains nested vertical map/list? | Auto-deduced unique | Fill rule                                                                                                                       |
| ------------------- | --------------------------------------------- | ------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| `ID` (outer map)    | ✅ Yes — contains `map<int32, Phase>`          | ❌ Not unique        | **Repeat** the same ID across multiple rows for each inner-map entry; non-key fields (e.g. `Name`) only filled on the first row |
| `Phase` (inner map) | ❌ No — value only contains horizontal list    | ✅ Unique            | Each `(ID, Phase)` combination appears **exactly once**                                                                         |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/excel/map.md (reported line 233)May include surrounding context.

md

**Key fill rules:**

| Key column          | Contains nested vertical map/list? | Auto-deduced unique | Fill rule                                                                                              |
| ------------------- | ---------------------------------- | ------------------- | ------------------------------------------------------------------------------------------------------ |
| `ID` (outer map)    | ✅ Yes                              | ❌ Not unique        | **Repeat** the same ID across multiple rows; non-key fields (e.g. `Name`) only filled on the first row |
| `Phase` (inner map) | ❌ No                               | ✅ Unique            | Each `(ID, Phase)` combination appears **exactly once**                                                |

Static analysis

No suspicious patterns detected.