microsoft-excel

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from Microsoft Excel workbooks which could contain adversarial instructions.
  • Ingestion points: Data is retrieved from workbooks via the @useclawlink/cli tool during execution of Excel actions.
  • Boundary markers: The skill instructions explicitly direct the agent to 'confirm with the user before any write,' serving as a human-in-the-loop safety measure.
  • Capability inventory: The agent can perform a variety of actions including adding charts, tables, and worksheets, and modifying workbook permissions using shell commands.
  • Sanitization: No specific content sanitization or structured boundary markers for cell data are defined.
  • [COMMAND_EXECUTION]: The skill utilizes the @useclawlink/cli package to perform actions. These commands are part of the core functionality provided by the vendor to facilitate the Microsoft Excel integration.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 05:46 PM