xlsx

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill documentation includes an explicit example that passes a password on the command line ("--protect your-password"), which encourages embedding a secret verbatim in generated commands and therefore requires the LLM to handle/output secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). At runtime, the workflow path scripts/xlsx_read.py (modes --json/--csv/--formulas/--notes/--names/--sheets) loads an input .xlsx and ingests free text from worksheet cell values and comments/notes (including any outsider-authored strings embedded in the workbook).