The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx -y @sbroenne/excelcli@latest to fetch the Excel CLI tool from the NPM registry. This package is maintained by the skill author and is a standard delivery mechanism for Node.js-based tooling.
[REMOTE_CODE_EXECUTION]: The use of npx to execute a remote package constitutes remote code execution. In this context, it is used to launch the primary tool for the skill and targets a package belonging to the skill vendor.
[COMMAND_EXECUTION]: The skill provides instructions to execute PowerShell scripts, specifically the start-cli.ps1 launcher, to perform Excel operations such as data refreshes, formula updates, and workbook automation.
[INDIRECT_PROMPT_INJECTION]: The skill operates on data from external Excel workbooks, which creates a potential surface for indirect prompt injection if workbooks contain malicious instructional content.
Ingestion points: Workbook contents, cell data, and formulas are read using the excelcli tool.
Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded content within workbooks.
Capability inventory: The skill can perform file system writes (saving workbooks) and execute commands via the PowerShell launcher.
Sanitization: No data validation or sanitization routines are mentioned for the content retrieved from Excel files.

excel-cli