excel-parser
Warn
Audited by Gen Agent Trust Hub on Mar 5, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: In
scripts/excel_parser.py, theinstall_dependencyfunction usessubprocess.check_callto executepip installcommands. This allows the skill to modify the system environment at runtime through shell execution. - [EXTERNAL_DOWNLOADS]: The
ExcelParserclass inscripts/excel_parser.pyis configured to automatically download and install well-known libraries from the Python Package Index if they are not detected during initialization. - [PROMPT_INJECTION]: The skill processes content from external Excel files and incorporates it into the agent's context via the
parse_excel_to_textmethod inscripts/excel_parser.py. It lacks robust sanitization to prevent the agent from following instructions potentially embedded within worksheet cells.
Audit Metadata