easyexcel-write
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data structures (DTOs, Maps, and Lists) to generate Excel files, creating a surface for indirect prompt injection. Maliciously crafted data inputs could potentially influence agent behavior if the resulting files are processed by the agent in later stages. The skill also demonstrates fetching images from user-supplied URLs, which could be exploited for Server-Side Request Forgery (SSRF) if the input URLs are not validated. \n
- Ingestion points: Data objects and lists passed to
EasyExcel.write().doWrite()orexcelWriter.write()methods in files such asexamples/simple/02-three-ways.mdandexamples/bigdata/24-page-write.md. \n - Boundary markers: No specific delimiters or safety instructions are provided to separate user data from program logic in the generated files. \n
- Capability inventory: File system writing (
EasyExcel.write(fileName, ...)) and network operations via image fetching (HttpUtil.downloadBytes(p.getImageUrl())inreferences/scenarios/business-scenarios.md). \n - Sanitization: The provided examples do not include explicit sanitization or validation logic for the data content or the integrity of external URLs being fetched for images.
Audit Metadata