Agent Sheet

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 7:06 AM UTC
• Version: 0.1.6

Overview

This skill is a disclosed spreadsheet CLI helper that can read and modify local workbooks, with guidance to keep changes scoped and verified.

Install this only if you trust the agent-sheet npm package and its publisher, or pin an audited version instead of @latest. When using it, treat write, delete, clear, import/export, and script js commands as real changes to local workbook or filesystem state, confirm the target entryId/sheet/range/path, and keep the built-in verification steps.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned npm Dependency Uses a Mutable Release Tag

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/verify_csv_preview.py:20

Finding

Negative Row Count Bypasses CSV Data-Row Verification

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad spreadsheet CLI with workbook-oriented capabilities such as inspection, sheet/range reads, precise writes, formula analysis, and bounded scripting. The supplied code instead implements a narrow CSV validation utility: it loads one CSV file, resolves A1-style cell references, and checks exact or non-empty cell contents. This is materially narrower and different in primary purpose from the declared spreadsheet/workbook tool. While CSV cell verification could be considered a small verification-related subfeature, the overall description does not accurately represent this code chunk's actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a general spreadsheet/workbook-oriented shell CLI with capabilities such as inspecting workbooks, reading/writing sheets and ranges, import/export handoff, constructing review tables, analyzing formulas, and bounded scripting. The supplied code chunk does not implement those behaviors. Instead, it is a narrow verification utility for comparing two CSV files' headers and first few rows, with an optional key-column check. While CSV preview verification could loosely relate to import/export validation, this code’s primary purpose is materially narrower and different from the declared spreadsheet CLI functionality, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file describes and exemplifies use of agent-sheet write table to write transformed data back into a workbook, which can affect user data and sheet integrity. While the flow explains verification steps, it does not warn that the operation modifies the destination sheet or advise validating the target before execution.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · playbooks/15-verify.md (reported line 112)May include surrounding context.

md

- counting rows and skipping header or sample checks after a shell transform
- using `file info` as a substitute for `sheet list` or `inspect workbook`
- verifying formulas from displayed values only when the formula surface matters
- claiming success because the export command returned zero without checking the output file
- skipping quoted-range verification for imported non-English sheets

## Stop / escalate

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file documents create() and deleteSheet() as available operations, and later also documents row/column/cell deletion and content clearing, but it does not warn users that these actions can permanently alter or remove spreadsheet data. Under the markdown-specific SQP-2 criteria, descriptions of behaviors affecting user data should include an explicit warning about impact or reversibility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file provides commands that write to a local file (./artifacts/claims.tsv and ./artifacts/claims_p1.tsv) and earlier sections also show agent-sheet write operations back into workbook ranges/tables, but the document does not include a warning that these commands modify data or create artifacts. Under SQP-2 for markdown files, examples that can affect user data or system state should disclose that behavior so users understand the impact before running them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown playbook instructs the agent to export a workbook to a local output path, which affects the filesystem. While the document describes the command mechanics, it does not include a user-facing warning about file creation/overwrite risk or other data-impact implications of writing the export target.

Content

No source excerpt is available for this finding.