xlsx-design-agent
Fail
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: CRITICALCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION] (MEDIUM): The skill utilizes
subprocess.runto execute AppleScript viaosascript, enabling interaction with the host operating system and Microsoft Excel. - [COMMAND_EXECUTION] (MEDIUM): VBA code is dynamically generated and executed using the
do Visual Basiccommand within AppleScript. The implementation inapplescript-patterns.mduses string interpolation, creating a potential surface for script injection if untrusted data is processed. - [EXTERNAL_DOWNLOADS] (LOW): The skill depends on standard third-party Python packages including
openpyxl,Pillow, andpandas, which must be installed via pip. - [EXTERNAL_DOWNLOADS] (MEDIUM): An automated scanner (URLite) flagged a phishing URL (
com.app) associated with the skill, suggesting potential risks in components of the skill not visible in the current snippets.
Recommendations
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata