excel-cli
Fail
Audited by Snyk on Mar 10, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.90). The skill explicitly requires capturing and reusing session IDs (and allows passing connection strings/passwords) as literal CLI arguments (e.g., --session , --connection-string), which forces the agent to include secret or token-like values verbatim in generated commands — an exfiltration risk.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md explicitly documents and requires use of the powerquery and connection workflows (see "Connection" and the "Power Query Development Lifecycle" / powerquery actions) which ingest TEXT/WEB/CSV sources and evaluate M code, meaning the agent can fetch and process arbitrary public web or CSV content that could influence subsequent commands.
Audit Metadata