The Agent Skills Directory

[PROMPT_INJECTION]: The skill implements specific defenses against indirect prompt injection (specifically Excel formula injection). It mandates that all user-supplied data starting with characters such as '=', '+', '-', or '@' must be stored as text to prevent the execution of malicious formulas.
[COMMAND_EXECUTION]: Utilizes uv run to manage the Python execution environment and run validation scripts. This is a standard and safe practice for task-specific automation.
[SAFE]: Includes a comprehensive validation script (scripts/check_xlsx.py) that acts as a security gate. This script scans the generated OOXML structure for dangerous formula patterns (e.g., WEBSERVICE, HYPERLINK, DDE, EXEC) and ensures that requirements like formula usage and charts are met using stable package-level checks rather than relying on potentially exploitable runtime attributes.

office-xlsx