Security risk report for @forgecat/anthropics_skills_xlsx v0.0.4
Source Integrity
Low
Profile is attributed to Anthropic (a known, legitimate organization) with a public GitHub repository reference.
No suspicious external URLs, typosquatted dependencies, or attacker-controlled package sources detected.
Agent Intent
Low
Content is purely instructional documentation for spreadsheet manipulation (reading, editing, formatting, formula construction) with no hidden directives to manipulate the AI agent.
Guidelines describe legitimate Excel best practices (color coding, formula standards, number formatting) and standard Python libraries (pandas, openpyxl) — no guidance poisoning or malicious knowledge injection.
No instructions to ignore system prompts, exfiltrate data, read credentials, install remote payloads, or hide its own instructions.
Details
Evidence
"Use this skill any time a spreadsheet file is the primary input or output..."
"Always use Excel formulas instead of calculating values in Python and hardcoding them."
"Professional Font", "Zero Formula Errors", "Color Coding Standards" — standard spreadsheet conventions.
Permissions
Low
No tool definitions or MCP servers declared in the profile; no excessive agency claims.
Skill scope is narrowly defined: spreadsheet file creation, editing, and analysis — directly aligned with stated purpose.
References to standard Python libraries (pandas, openpyxl) and a local recalculation script (scripts/recalc.py) are appropriate for the task domain.
Details
Evidence
"Use this skill any time a spreadsheet file is the primary input or output..."
No shell, file_write, file_delete, or web_fetch tools with alwaysApply=true or broad globs.
Dependencies listed as "None" in the profile metadata.
MCP Risk
Low
No MCP servers defined in the profile.
No hidden instructions in tool descriptions or arbitrary binary execution.
References to LibreOffice and local Python scripts are scoped to spreadsheet processing.
Details
Evidence
"MCP servers (untrusted data): (none)"
"LibreOffice Required for Formula Recalculation" — documented, local dependency for a legitimate use case.
ForgeCat