excel-parser

Warn

Audited by Gen Agent Trust Hub on Mar 15, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The function install_dependency in scripts/excel_parser.py uses subprocess.check_call to execute pip install commands. This allows the skill to modify the host environment's Python packages at runtime.\n- [EXTERNAL_DOWNLOADS]: The skill automatically downloads and installs libraries from the Python Package Index (PyPI), specifically python-calamine, xlrd, and openpyxl, if they are not already installed on the system.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) due to its data processing workflow.\n
  • Ingestion points: The skill reads data from user-provided Excel files (.xls, .xlsx, .xlsm, etc.) in scripts/excel_parser.py.\n
  • Boundary markers: Absent; there are no specific markers or instructions used to separate the extracted spreadsheet data from other agent instructions.\n
  • Capability inventory: The skill possesses command execution capabilities via subprocess.check_call and filesystem write access via openpyxl's wb.save and update methods in scripts/excel_parser.py.\n
  • Sanitization: Absent; extracted cell content is converted to strings but is not sanitized or filtered to prevent the agent from interpreting it as instructions.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 15, 2026, 01:21 PM