Loading
heating the forge...
ForgeCat
Agent Profiles
Docs
Sell Agents
Feedback
forgecat
/
forgecat
/
openai_skills_spreadsheet
/
security
openai_skills_spreadsheet
Security risk report for
@forgecat/openai_skills_spreadsheet
v0.0.11
Source Integrity
Low
Profile is sourced from OpenAI's official public repository (https://github.com/openai/skills) with a specific commit hash and Apache-2.0 license.
Metadata is consistent with a legitimate, curated skill from a known trusted source.
Agent Intent
Low
Content is purely instructional documentation for spreadsheet workflows using standard, well-known libraries (openpyxl, pandas, matplotlib).
No hidden directives to ignore instructions, exfiltrate data, leak system prompts, or install malicious dependencies.
Guidance on formula safety, formatting, and citation is legitimate best-practice documentation, not poisoning.
Details
Evidence
IMPORTANT: System and user instructions always take precedence.
Use formulas for derived values instead of hardcoding results.
Cite sources inside the spreadsheet using plain-text URLs.
Permissions
Low
No tools or hooks are declared in the profile; the skill is purely instructional guidance for the agent.
Recommended libraries (openpyxl, pandas) and system tools (LibreOffice, Poppler) are standard, legitimate, and scoped to spreadsheet operations.
File operations are confined to temporary and output directories with clear naming conventions.
Details
Evidence
Use `tmp/spreadsheets/` for intermediate files; delete them when done.
Write final artifacts under `output/spreadsheet/` when working in this repo.
Prefer `uv` for dependency management.
MCP Risk
Low
No MCP servers are defined in the profile.
No external host access, arbitrary binary execution, or unrestricted filesystem/network permissions are requested.
Details
Evidence
MCP servers section: (none)
Evaluation Details
Status
Completed
Checks completed
4/4
Flagged
0
Evaluated
8/31/2026
@forgecat/openai_skills_spreadsheet — Security Risk Report | ForgeCat
ForgeCat