Security risk report for @forgecat/anthropics_skills_xlsx v0.0.5
Source Integrity
Low
Profile is attributed to Anthropic (reputable, known-safe source) with clear provenance: original repository https://github.com/anthropics/skills, commit 5128e18, licensed under LicenseRef-Anthropic-Terms.
No suspicious or typosquatted dependencies; no external package installation instructions beyond standard npm forgecat install.
Agent Intent
Low
Content is purely functional documentation for spreadsheet manipulation (xlsx/csv/tsv file handling); no instructions to ignore system prompts, read credentials, exfiltrate data, or install remote payloads.
Technical guidance (pandas, openpyxl, formula construction, color coding standards) is legitimate best-practice instruction for financial modeling and data work, not poisoned guidance steering toward attacker goals.
No role hijacking, prompt injection phrasing, or hidden directives to manipulate the AI's behavior or reveal system state.
Details
Evidence
"Use this skill any time a spreadsheet file is the primary input or output..."
"Always use Excel formulas instead of calculating values in Python and hardcoding them."
"Source: Company 10-K, FY2024, Page 45, Revenue Note, [SEC EDGAR URL]" (documentation example, not instruction to exfiltrate)
Permissions
Low
No tools or MCP servers are declared in this profile; it is purely instructional documentation for how to use pandas and openpyxl libraries.
The skill description is narrowly scoped to spreadsheet file operations (open, read, edit, create, convert formats) matching its stated purpose.
No file_write, file_delete, shell, or other high-risk tool categories are invoked; the profile does not demand excessive agency.
Details
Evidence
"Declared tools: (none declared)"
"MCP servers: (none)"
Skill scope: "open, read, edit, or fix an existing .xlsx, .xlsm, .csv, or .tsv file"
MCP Risk
Low
No MCP servers are defined in this profile.
The profile relies on standard, well-known Python libraries (pandas, openpyxl) and LibreOffice for formula recalculation—all legitimate, open-source tools with no hidden instructions or arbitrary binary execution.
Details
Evidence
"MCP servers (untrusted data): (none)"
"LibreOffice Required for Formula Recalculation: You can assume LibreOffice is installed for recalculating formula values using the `scripts/recalc.py` script."
ForgeCat