excel-model
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to generate and execute a Python script using the openpyxl library. This is the intended behavior for creating actual .xlsx files that users can download and use.
- [PROMPT_INJECTION]: The skill facilitates the processing of untrusted user data (such as model assumptions and structural requirements) to generate spreadsheet logic, representing an indirect injection surface.
- Ingestion points: User-provided input defining the model's drivers, outputs, and structure (SKILL.md).
- Boundary markers: Absent. The skill does not instruct the agent to use specific delimiters when incorporating user data into the generated script.
- Capability inventory: The agent's ability to execute generated code (SKILL.md).
- Sanitization: Absent. There are no instructions to sanitize or validate user-provided strings before they are used in script generation.
Audit Metadata