ClawHub
Back to skill

Security audit

xlsx

Security checks for vulnerabilities and agentic risk

Overview

This spreadsheet skill is useful and mostly purpose-aligned, but its formula recalculation script persistently modifies the user's LibreOffice macro profile in a way that is under-disclosed and too broad for routine spreadsheet work.

Review before installing. This skill can create and edit spreadsheets as expected, but formula recalculation may add a persistent LibreOffice macro to your user profile and may overwrite or trust an existing Module1.xba. Prefer using it only in a contained environment or after confirming you are comfortable with LibreOffice profile changes and workbook writes.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Error
Location
recalc.py:17
Finding

Persistent Installation of a LibreOffice Application Macro

Content
View full analysis
Sub RecalculateAndSave() ThisComponent.calculateAll() ThisComponent.store() ThisComponent.close(True) End Sub """ try: with open(macro_file, "w") as f: f.write(macro_content) return True except Exception: return False ``` ### Technical Analysis The recalculation script installs `Module1.xba` in LibreOffice's persistent, user-wide macro directory. On Linux, the target is under `~/.config/libreoffice/4/user/basic/Standard`; on macOS, it is under `~/Library/Application Support/LibreOffice/4/user/basic/Standard`. This macro remains installed after the script exits and can affect later LibreOffice sessions. Installing application-level executable content is not necessary ...[truncated 1556 chars]
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Error
Location
recalc.py:23
Finding

Execution of an Untrusted Existing LibreOffice Macro

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The description presents a broad spreadsheet skill, but the documented behavior includes writing a LibreOffice macro into the user's local configuration and executing external LibreOffice subprocesses. This is more privileged and persistent than the declared purpose suggests, so users and orchestrators may invoke it without understanding that it changes local configuration and runs external tooling.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill instructs use of file-writing and shell-executed recalculation workflows but does not declare an explicit tool scope or permission boundary. That increases the chance the agent can modify files or invoke subprocesses more broadly than users expect, especially when handling untrusted spreadsheets or paths.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The invocation description is extremely broad and can match many ordinary spreadsheet-related requests, which raises the likelihood this skill is selected in situations where its shell/file-modifying behavior is unnecessary. Overbroad routing increases accidental exposure to side effects such as overwriting files or triggering external recalculation steps.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

CRITICAL: Use Formulas, Not Hardcoded Values

Always use Excel formulas instead of calculating values in Python and hardcoding them. This ensures the spreadsheet remains dynamic and updateable.

❌ WRONG - Hardcoding Calculated Values

python

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill provides direct file editing patterns, row/column insertion, deletion, and saving without requiring an explicit warning or confirmation about overwriting existing spreadsheet content. In context, spreadsheet modifications can silently destroy formulas, formatting, or business data, especially when operating on user-supplied workbooks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The recalculation routine writes a macro into the user's global LibreOffice profile, creating persistent application-level state outside the scope of a single spreadsheet operation. That broadens the skill's privileges and can change future LibreOffice behavior for the user or other processes without clear consent, which is dangerous even if the macro content itself appears simple.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Installing and invoking a global LibreOffice Basic macro gives the skill an application-configuration capability that exceeds ordinary spreadsheet recalculation. In a security review, persistent macro installation is especially sensitive because it normalizes modifying a macro-capable global profile and increases attack surface beyond the immediate file being processed.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · recalc.py (reported line 32)May include surrounding context.

python
return True

    if not os.path.exists(macro_dir):
        subprocess.run(["soffice", "--headless", "--terminate_after_init"], capture_output=True, timeout=10)
        os.makedirs(macro_dir, exist_ok=True)

    macro_content = """<?xml version="1.0" encoding="UTF-8"?>

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script silently writes a macro file into the user's LibreOffice configuration without warning or confirmation, creating a persistent side effect that users are unlikely to expect from spreadsheet recalculation. Silent persistence in a macro directory is risky because it reduces transparency, complicates auditability, and can interact with future LibreOffice sessions.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · recalc.py (reported line 86)May include surrounding context.

python
if platform.system() == "Darwin":
            # Check if gtimeout is available on macOS
            try:
                subprocess.run(["gtimeout", "--version"], capture_output=True, timeout=1, check=False)
                timeout_cmd = "gtimeout"
            except (FileNotFoundError, subprocess.TimeoutExpired):
                pass

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · recalc.py (reported line 94)May include surrounding context.

python
if timeout_cmd:
            cmd = [timeout_cmd, str(timeout), *cmd]

    result = subprocess.run(cmd, capture_output=True, text=True)

    if result.returncode != 0 and result.returncode != 124:  # 124 is timeout exit code
        error_msg = result.stderr or "Unknown error during recalculation"

Static analysis

No suspicious patterns detected.