excel-pivot-wizard
Pass
Audited by Gen Agent Trust Hub on Mar 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill's instructions and logic are consistent with its stated goal of performing business intelligence and data summarization tasks in Excel. The workflow follows best practices for data inspection and visualization.
- [EXTERNAL_DOWNLOADS]: The skill requires the
@negokaz/excel-mcp-serverpackage to provide the necessary tooling for Excel manipulation. This dependency is standard for the functionality described. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from Excel spreadsheets, creating a potential surface for indirect prompt injection if those files contain adversarial content.
- Ingestion points: Reads content from local
.xlsxfiles (SKILL.md, Step 1). - Boundary markers: Absent from the prompt instructions.
- Capability inventory: The skill uses
Read,Write,Edit, andBashtools to interact with the file system and execute the MCP server (SKILL.md, frontmatter). - Sanitization: No explicit sanitization or filtering of cell content is mentioned before processing.
Audit Metadata