Agent Sheet

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 7:06 AM UTC
• Version: 0.1.6

Overview

This skill is a disclosed spreadsheet CLI helper that can read and modify local workbooks, with guidance to keep changes scoped and verified.

Install this only if you trust the agent-sheet npm package and its publisher, or pin an audited version instead of @latest. When using it, treat write, delete, clear, import/export, and script js commands as real changes to local workbook or filesystem state, confirm the target entryId/sheet/range/path, and keep the built-in verification steps.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18
• Finding: Unpinned npm Dependency Uses a Mutable Release Tag<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:18-21` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```yaml install: - kind: node package: agent-sheet@latest bins: - agent-sheet ``` ### Technical Analysis The Skill installs `agent-sheet` through the mutable npm tag `latest`. It does not specify an audited exact version, package integrity hash, lockfile, or immutable source revision. As a result, the dependency retrieved during a future installation may differ from the dependency that existed when this Skill was reviewed. The repository and documentation links do not cryptographically bind the installed npm artifact to reviewed source code. This creates a supply-chain exposure: compromise of the npm package, its publisher account, or a future unsafe release could replace the effective executable without requiring any modification to this repository. ### Attack Path 1. An attacker compromises the `agent-sheet` npm package, its publisher credentials, or its release pipeline. 2. The attacker publishes a malicious release and assigns it to the `latest` tag. 3. A user installs the Skill after that publication. 4. The installer resolves `agent-sheet@latest` to the attacker-controlled release. 5. Malicious code may execute during package installation or when the user invokes the installed `agent-sheet` binary. 6. The code runs with the permissions of the user or Agent process and can potentially access files and workbook data available to that process. ### Impact Assessment Successful exploitation could permit arbitrary code execution under the installing user's account. The accessible scope may include: - Workbooks processed by the CLI. - Files readable or writable by the user. - Environment variables inherited by installation or CLI processes. - Local `agent-sheet` workspace state. - Network resources available to the process. The dependency declaration itself does not grant ...[truncated 206 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the mutable tag with an exact, audited version: ```yaml package: agent-sheet@X.Y.Z ``` 2. Where the Skill installation mechanism supports it, verify the npm package integrity hash. 3. Maintain a lockfile or equivalent immutable dependency manifest for reproducible installation. 4. Review the package provenance, publisher identity, and release signatures before upgrading. 5. Introduce a controlled upgrade process in which each new version is separately audited and tested before changing the pinned version. 6. Consider enforcing trusted registries and npm provenance verification in the deployment environment. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/verify_csv_preview.py:20
• Finding: Negative Row Count Bypasses CSV Data-Row Verification<![CDATA[ ## Vulnerability Details **File Location**: `scripts/verify_csv_preview.py:20, 42-51, 78-82` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Low ### Vulnerable Code ```python parser.add_argument("--rows", type=int, default=3, help="Number of data rows to compare") ``` ```python if len(actual_data) < args.rows: fail(f"actual CSV has only {len(actual_data)} data rows, need at least {args.rows}") if len(expected_data) < args.rows: fail(f"expected CSV has only {len(expected_data)} data rows, need at least {args.rows}") for offset in range(args.rows): expected_row = expected_data[offset] actual_row = actual_data[offset] if expected_row != actual_row: fail( f"row {offset + 2} mismatch\n" f"expected: {expected_row}\n" f"actual: {actual_row}" ) ``` ```python print( f"CSV preview verification passed: header + first {args.rows} data rows" + (f" + key column {args.key_column}" if args.key_column else "") ) ``` ### Technical Analysis The `--rows` argument accepts any integer and is not validated as non-negative. If a caller supplies a negative value such as `--rows -1`, both row-count checks are bypassed because a non-negative list length is not less than `-1`. Python's `range(-1)` produces an empty sequence, so the row-comparison loop performs no comparisons. The script nevertheless prints a success message. If `--key-column` is supplied, slices such as `expected_data[:-1]` may still compare a partial key list, but the full-row comparison remains bypassed. The header comparison is still performed, so this issue does not bypass all validation. It specifically undermines the intended verification of the first N complete data rows. ### Attack Path 1. A caller prepares an actual CSV with the expected header but altered data rows. 2. The caller invokes the verifier with a negative count, for example: ```bash python3 scripts/verify_csv_prev ...[truncated 950 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Reject negative values during argument parsing: ```python def non_negative_int(value): try: parsed = int(value) except ValueError as exc: raise argparse.ArgumentTypeError("must be an integer") from exc if parsed < 0: raise argparse.ArgumentTypeError("must be non-negative") return parsed parser.add_argument( "--rows", type=non_negative_int, default=3, help="Number of data rows to compare", ) ``` 2. If at least one data row must always be checked, require a strictly positive integer instead of allowing zero. 3. Add defensive validation in `main()` even if argument parsing performs validation: ```python if args.rows < 1: fail("--rows must be at least 1") ``` 4. Add regression tests covering `--rows -1`, `--rows 0`, insufficient input rows, and mismatched data. 5. Ensure wrappers and examples do not accept an untrusted row count without validation. 6. Change the success message to report only checks that were actually executed. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a broad spreadsheet CLI with workbook-oriented capabilities such as inspection, sheet/range reads, precise writes, formula analysis, and bounded scripting. The supplied code instead implements a narrow CSV validation utility: it loads one CSV file, resolves A1-style cell references, and checks exact or non-empty cell contents. This is materially narrower and different in primary purpose from the declared spreadsheet/workbook tool. While CSV cell verification could be considered a small verification-related subfeature, the overall description does not accurately represent this code chunk's actual behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description presents a general spreadsheet/workbook-oriented shell CLI with capabilities such as inspecting workbooks, reading/writing sheets and ranges, import/export handoff, constructing review tables, analyzing formulas, and bounded scripting. The supplied code chunk does not implement those behaviors. Instead, it is a narrow verification utility for comparing two CSV files' headers and first few rows, with an optional key-column check. While CSV preview verification could loosely relate to import/export validation, this code’s primary purpose is materially narrower and different from the declared spreadsheet CLI functionality, so this is a description-behavior mismatch.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This markdown file describes and exemplifies use of `agent-sheet write table` to write transformed data back into a workbook, which can affect user data and sheet integrity. While the flow explains verification steps, it does not warn that the operation modifies the destination sheet or advise validating the target before execution.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- counting rows and skipping header or sample checks after a shell transform
- using `file info` as a substitute for `sheet list` or `inspect workbook`
- verifying formulas from displayed values only when the formula surface matters
- claiming success because the export command returned zero without checking the output file
- skipping quoted-range verification for imported non-English sheets

## Stop / escalate

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This markdown file documents `create()` and `deleteSheet()` as available operations, and later also documents row/column/cell deletion and content clearing, but it does not warn users that these actions can permanently alter or remove spreadsheet data. Under the markdown-specific SQP-2 criteria, descriptions of behaviors affecting user data should include an explicit warning about impact or reversibility.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This markdown file provides commands that write to a local file (`./artifacts/claims.tsv` and `./artifacts/claims_p1.tsv`) and earlier sections also show `agent-sheet write` operations back into workbook ranges/tables, but the document does not include a warning that these commands modify data or create artifacts. Under SQP-2 for markdown files, examples that can affect user data or system state should disclose that behavior so users understand the impact before running them.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: This markdown playbook instructs the agent to export a workbook to a local output path, which affects the filesystem. While the document describes the command mechanics, it does not include a user-facing warning about file creation/overwrite risk or other data-impact implications of writing the export target.

Static analysis

No suspicious patterns detected.