excel-cli

Fail

Audited by Snyk on Mar 10, 2026

Risk Level: HIGH
Full Analysis

HIGH W007: Insecure credential handling detected in skill instructions.

  • Insecure credential handling detected (high risk: 0.90). The skill explicitly requires capturing and reusing session IDs (and allows passing connection strings/passwords) as literal CLI arguments (e.g., --session , --connection-string), which forces the agent to include secret or token-like values verbatim in generated commands — an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

  • Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md explicitly documents and requires use of the powerquery and connection workflows (see "Connection" and the "Power Query Development Lifecycle" / powerquery actions) which ingest TEXT/WEB/CSV sources and evaluate M code, meaning the agent can fetch and process arbitrary public web or CSV content that could influence subsequent commands.
Audit Metadata
Risk Level
HIGH
Analyzed
Mar 10, 2026, 04:58 PM