excel-mcp-report-formatting
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from Excel workbooks which serves as a potential surface for indirect injection.
- Ingestion points: Accesses worksheet data, ranges, and table metadata in references/report-formatting.md to apply styles.
- Boundary markers: No explicit instruction delimiters are defined for the data read from cells.
- Capability inventory: Uses formatting tools (range_format, range) and view management (window). It does not use general code execution or network tools.
- Sanitization: No validation or sanitization of cell content is performed before applying formatting logic.
- [SAFE]: The skill explicitly instructs the agent to protect sensitive information, warning against the exposure of private source paths, credentials, or connection strings.
- [SAFE]: External links point to documentation for the Excel MCP server and do not involve remote code execution or package installation.
Audit Metadata