excel-mcp
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires a one-time runtime download from the author's GitHub repository (sbroenne/mcp-server-excel). This is a vendor-controlled resource necessary for the skill's operation.
- [DATA_EXFILTRATION]: Provides optional features to send DAX and Power Query M code to external formatting services (daxformatter.com and powerqueryformatter.com). These operations are documented and explicitly gated by a requirement for user consent.
- [PROMPT_INJECTION]: Skill instructions mandate high autonomy by forbidding the agent from asking clarifying questions ('NEVER Ask Clarifying Questions'), directing it to use tool-based discovery instead. This is an operational efficiency guideline rather than a safety bypass.
- [COMMAND_EXECUTION]: Enables extensive automation of the host Excel application using COM-level operations via the MCP server. This includes workbook management, Data Model manipulation, and Power Query execution.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface through reading Excel workbooks. While it has powerful capabilities like file writing, it includes security guidance for XML mapping (rejecting DTDs and external schemas) and requires manual user intervention for sensitive settings like VBA trust.
Audit Metadata