excel-processor
Pass
Audited by Gen Agent Trust Hub on Apr 26, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data from external files (Excel, CSV), creating an attack surface for indirect prompt injection. Malicious instructions embedded in spreadsheet cells could potentially influence the agent's behavior during processing.
- Ingestion points: Data loading steps in SKILL.md using pd.read_excel and pd.read_csv.
- Boundary markers: Absent. The instructions do not provide delimiters or warnings to the agent to ignore embedded commands within the tabular data.
- Capability inventory: The skill allows for local file system read and write operations using the pandas library.
- Sanitization: Absent. There is no logic provided to sanitize or validate the content of the data files against potential injection strings.
Audit Metadata