univer-cli

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:52 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward wrapper for installing and using a local spreadsheet CLI, with a disclosed npm dependency risk but no hidden or unrelated behavior found.

Before installing, verify that `univer-cli` is the package you intend to trust, prefer a pinned reviewed version or project-local install when possible, and avoid running the global npm install with elevated privileges unless you have separately reviewed the package.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Third-Party npm Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9-18
Vulnerability Type: Supply-chain risk caused by an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

json

"install":
  [
    {
      "id": "node",
      "kind": "node",
      "package": "univer-cli",
      "bins": ["unv"],
      "label": "Install univer-cli (npm)",
    },
  ],

The installation instructions also direct users to execute npm i -g univer-cli, without specifying a reviewed version or package integrity value.

Technical Analysis

The skill declares univer-cli by package name only. Consequently, npm resolves the package version from mutable registry metadata at installation time, normally selecting the latest compatible release. The effective executable code is therefore not fixed to the content reviewed in this project.

npm packages can contain lifecycle scripts that execute during installation. A compromised maintainer account, malicious future release, registry compromise, or package ownership transfer could cause subsequently installed versions to execute attacker-controlled code. Global installation also places the unv executable in a shared command location, expanding the effect beyond a single isolated project.

The repository contains only SKILL.md; it does not contain the dependency source, a lockfile, an integrity hash, or other material through which the behavior of the installed package could be independently verified. This finding does not establish that the current univer-cli package is malicious. It identifies an unsafe, mutable supply-chain trust boundary.

Attack Path

1. An attacker compromises the npm package publisher, package ownership, registry release channel, or a future package release.
2. The attacker publishes a malicious version under the existing univer-cli package name.
3. A user follows the skill metadata or documentation and installs univer-cli ...[truncated 965 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact version that has undergone security review, rather than resolving the latest release:

   json

   "package": "univer-cli@<reviewed-exact-version>"
   

2. Update the documented command to use the same exact reviewed version:

   bash

   npm install -g univer-cli@<reviewed-exact-version>
   

3. Prefer a project-local installation with a committed lockfile over global installation, reducing shared-system effects and preserving deterministic resolution.
4. Verify npm registry integrity metadata and document the expected publisher, repository, package version, and artifact digest.
5. Review the selected package version, including its transitive dependencies and npm lifecycle scripts, before recommending installation.
6. Where compatible with the package, install with lifecycle scripts disabled and enable only explicitly reviewed setup steps:

   bash

   npm install --ignore-scripts --save-exact univer-cli@<reviewed-exact-version>
   

7. Run spreadsheet processing in a least-privileged, isolated environment with restricted filesystem and network access, especially when handling untrusted workbooks.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep