Security audit

Excel2Insights

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it says: analyze user-provided spreadsheets locally and create report files and charts.

Install only if you are comfortable letting the agent read the spreadsheet you provide and write derived outputs locally. Avoid using highly sensitive spreadsheets unless you choose a secure output directory and delete generated reports, charts, and analysis JSON when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The skill describes generating reports and chart image files from uploaded datasets but does not clearly warn users that portions of their data may be persisted to disk in output files. This can create unintended data retention or secondary exposure risks, especially when datasets contain sensitive business or personal information and users assume analysis is ephemeral.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The example invocations are very broad natural-language phrases such as '帮我分析这份销售数据' and '看看有没有异常数据', which can overlap with ordinary user requests and may cause the skill to auto-trigger unexpectedly. In an agent environment, ambiguous trigger phrasing increases the chance of unintentional execution of a multi-step pipeline that reads files and generates outputs without the user explicitly selecting this skill.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The walkthrough advertises one-click pipeline execution and lists generated artifacts under the local output/ directory, but it does not clearly warn users up front that running the skill writes files to disk. In agentic contexts, undocumented side effects can surprise users, clutter workspaces, overwrite existing artifacts, or expose derived data in predictable locations.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script returns raw `head` and `tail` rows from any supplied spreadsheet or CSV directly to stdout as JSON, which can expose sensitive records such as PII, credentials, financial data, or proprietary business data. In an agent skill context, this is more dangerous because the tool is designed for automated ingestion and structured output, making unintended downstream propagation or logging of file contents likely.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pandas>=2.0.0 numpy>=1.24.0 openpyxl>=3.1.0 matplotlib>=3.7.0
Confidence: 95% confidence
Finding: pandas>=2.0.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: pandas>=2.0.0 numpy>=1.24.0 openpyxl>=3.1.0 matplotlib>=3.7.0 seaborn>=0.12.0
Confidence: 95% confidence
Finding: numpy>=1.24.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: pandas>=2.0.0 numpy>=1.24.0 openpyxl>=3.1.0 matplotlib>=3.7.0 seaborn>=0.12.0 tabulate>=0.9.0
Confidence: 95% confidence
Finding: openpyxl>=3.1.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: pandas>=2.0.0 numpy>=1.24.0 openpyxl>=3.1.0 matplotlib>=3.7.0 seaborn>=0.12.0 tabulate>=0.9.0
Confidence: 95% confidence
Finding: matplotlib>=3.7.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy>=1.24.0 openpyxl>=3.1.0 matplotlib>=3.7.0 seaborn>=0.12.0 tabulate>=0.9.0
Confidence: 95% confidence
Finding: seaborn>=0.12.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: openpyxl>=3.1.0 matplotlib>=3.7.0 seaborn>=0.12.0 tabulate>=0.9.0
Confidence: 95% confidence
Finding: tabulate>=0.9.0

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.