office-excel
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
uvtool to execute Python scripts, which involves downloading theopenpyxlpackage from the official Python Package Index (PyPI). - [PROMPT_INJECTION]: The skill handles data from external sources including Excel spreadsheets, Markdown files, and JSON data, which constitutes an indirect prompt injection surface.
- Ingestion points: The scripts
read_excel.pyandwrite_excel.pyingest data from user-provided file paths and standard input. - Boundary markers: There are no specific delimiters or instructions provided to the agent to differentiate between data content and potential embedded instructions.
- Capability inventory: The skill allows for local file system read and write operations.
- Sanitization: The content is parsed into structured formats but is not filtered for instruction-like strings.
Audit Metadata