xlsx-win

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Several links point to personal/file-hosting or archive downloads (Dropbox, GitHub wiki 7z, a ZIP from thespreadsheetguru) which are common vectors for distributing macro-bearing or archived malware, and one URL embeds credentials in the URL which is a clear security/credential-leak risk.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill instructs running local PowerShell with "ExecutionPolicy Bypass" (a security-policy bypass) and directs building/running a local supervisor that launches Excel COM—actions that encourage bypassing host security controls and executing code on the machine.