excel-subtotal-audit
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external Excel workbooks, creating a vulnerability surface where instructions embedded in cell values could attempt to influence the agent.
- Ingestion points: The skill reads cell values and formulas from workbooks using
load_workbookas described in Step 1 and the Python sketch. - Boundary markers: Absent. The skill does not provide specific instructions to the agent to treat cell content as data only or to ignore embedded instructions.
- Capability inventory: The skill uses
openpyxlfor file reading, utilizes regular expressions for formula parsing, and prints cell content to the execution log. - Sanitization: Absent. Cell values are extracted and printed without escaping or validation against unexpected instruction patterns.
- [EXTERNAL_DOWNLOADS]: The skill references the Python package
openpyxl, which is a widely used and established library for spreadsheet manipulation.
Audit Metadata