Versioned security assessment

Report ID: SA-02BE9409

8/9/2026, 8:53:32 AM

minimax-xlsx security assessment v5

Skill Security Certification Report

Scanner version 3.0.0 Audit model: codex Latest published report

Skill name: minimax-xlsx
Version: v1.0
Maintainer: MiniMax-AI
Source: github.com/MiniMax-AI/skills/tree/main/skills/minimax-xlsx
Coverage: 25 Files scanned · 6,822 Lines analyzed
Policy version: skillstore-security-audit-policy-v1

Highest confirmed finding severity

High

2 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static alerts are scanner mismatches caused by OOXML namespace URIs, Markdown backticks, XML syntax, and safe argument-array subprocess calls. Confirmed risks include predictable shared temporary paths and recursive deletion of a caller-supplied output directory. Semantic review also found an agent-control instruction and unbounded processing of untrusted workbook archives.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

25 Files scanned · 6,822 Lines analyzed

64 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Commit and path bound
Artifact

Content and tree hashes bound
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 48 evidence locations

Filesystem access

May read or write local files.

Observed in 79 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 47 evidence locations

Capability review items (62)

High

scripts/xlsx_unpack.py:43

Python shutil operations

shutil.rmtree(output_dir)

The CLI recursively deletes any existing caller-supplied output directory before extraction. A mistaken or attacker-influenced path can cause destructive deletion outside a dedicated workspace.

Medium

references/create.md:62

Temp directory access

cp -r SKILL_DIR/templates/minimal_xlsx/ /tmp/xlsx_work/

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/create.md:68

Temp directory access

/tmp/xlsx_work/

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/create.md:251

Temp directory access

> /tmp/xlsx_work/xl/sharedStrings.xml

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/create.md:258

Temp directory access

> /tmp/xlsx_work/xl/sharedStrings.xml

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/create.md:492

Temp directory access

python3 SKILL_DIR/scripts/xlsx_pack.py /tmp/xlsx_work/ /path/to/output.xlsx

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/edit.md:50

Temp directory access

python3 SKILL_DIR/scripts/xlsx_unpack.py input.xlsx /tmp/xlsx_work/

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/edit.md:74

Temp directory access

grep -c "<si>" /tmp/xlsx_work/xl/sharedStrings.xml

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/edit.md:83

Temp directory access

grep -c "<xf " /tmp/xlsx_work/xl/styles.xml

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/edit.md:125

Temp directory access

python3 SKILL_DIR/scripts/xlsx_pack.py /tmp/xlsx_work/ output.xlsx

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/edit.md:476

Temp directory access

grep -r "Sheet1!" /tmp/xlsx_work/xl/worksheets/

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/edit.md:511

Temp directory access

python3 SKILL_DIR/scripts/xlsx_shift_rows.py /tmp/xlsx_work/ insert 5 1

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/edit.md:514

Temp directory access

python3 SKILL_DIR/scripts/xlsx_shift_rows.py /tmp/xlsx_work/ delete 8 1

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/edit.md:521

Temp directory access

python3 SKILL_DIR/scripts/xlsx_pack.py /tmp/xlsx_work/ output.xlsx

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/edit.md:651

Temp directory access

python3 SKILL_DIR/scripts/xlsx_pack.py /tmp/xlsx_work/ output.xlsx

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/edit.md:657

Temp directory access

python3 SKILL_DIR/scripts/libreoffice_recalc.py output.xlsx /tmp/recalc.xlsx

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/edit.md:658

Temp directory access

python3 SKILL_DIR/scripts/formula_check.py /tmp/recalc.xlsx

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/fix.md:12

Temp directory access

python3 SKILL_DIR/scripts/xlsx_unpack.py input.xlsx /tmp/xlsx_work/

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/fix.md:18

Temp directory access

python3 SKILL_DIR/scripts/xlsx_pack.py /tmp/xlsx_work/ output.xlsx

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/format.md:456

Temp directory access

python3 SKILL_DIR/scripts/xlsx_unpack.py input.xlsx /tmp/xlsx_fmt/

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/format.md:461

Temp directory access

mkdir -p /tmp/xlsx_fmt && cp input.xlsx /tmp/xlsx_fmt/input.xlsx

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/format.md:462

Temp directory access

cd /tmp/xlsx_fmt && unzip input.xlsx -d unpacked/

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/format.md:520

Temp directory access

python3 SKILL_DIR/scripts/style_audit.py /tmp/xlsx_fmt/unpacked/

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/format.md:524

Temp directory access

python3 SKILL_DIR/scripts/xlsx_pack.py /tmp/xlsx_fmt/unpacked/ /tmp/output.xlsx

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/format.md:525

Temp directory access

python3 SKILL_DIR/scripts/formula_check.py /tmp/output.xlsx

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/format.md:531

Temp directory access

grep -o 's="[0-9]*"' /tmp/xlsx_fmt/unpacked/xl/worksheets/sheet1.xml \

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/format.md:535

Temp directory access

grep 'cellXfs count' /tmp/xlsx_fmt/unpacked/xl/styles.xml

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/format.md:541

Temp directory access

python3 SKILL_DIR/scripts/xlsx_pack.py /tmp/xlsx_fmt/unpacked/ output.xlsx

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/format.md:546

Temp directory access

cd /tmp/xlsx_fmt/unpacked/

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/validate.md:211

Temp directory access

python3 SKILL_DIR/scripts/xlsx_unpack.py /path/to/file.xlsx /tmp/xlsx_inspect/

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/validate.md:252

Temp directory access

grep -h "<f>" /tmp/xlsx_inspect/xl/worksheets/*.xml | grep "!"

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/validate.md:255

Temp directory access

grep -o 'name="[^"]*"' /tmp/xlsx_inspect/xl/workbook.xml | grep -v sheetId

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/validate.md:311

Temp directory access

python3 SKILL_DIR/scripts/libreoffice_recalc.py /path/to/input.xlsx /tmp/recalculated.xlsx

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/validate.md:314

Temp directory access

python3 SKILL_DIR/scripts/libreoffice_recalc.py /path/to/input.xlsx /tmp/recalculated.xlsx --timeout

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/validate.md:347

Temp directory access

python3 SKILL_DIR/scripts/formula_check.py /tmp/recalculated.xlsx

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/validate.md:697

Temp directory access

python3 SKILL_DIR/scripts/libreoffice_recalc.py /path/to/output.xlsx /tmp/recalculated.xlsx

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/validate.md:698

Temp directory access

python3 SKILL_DIR/scripts/formula_check.py /tmp/recalculated.xlsx

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/validate.md:730

Temp directory access

python3 SKILL_DIR/scripts/formula_check.py /path/to/user_file.xlsx --json > /tmp/validation_results.

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/validate.md:733

Temp directory access

python3 SKILL_DIR/scripts/xlsx_unpack.py /path/to/user_file.xlsx /tmp/xlsx_inspect/

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/validate.md:736

Temp directory access

python3 SKILL_DIR/scripts/libreoffice_recalc.py /path/to/user_file.xlsx /tmp/user_file_recalc.xlsx

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/validate.md:739

Temp directory access

python3 SKILL_DIR/scripts/formula_check.py /tmp/user_file_recalc.xlsx --json > /tmp/validation_after

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/validate.md:744

Temp directory access

before = json.load(open("/tmp/validation_results.json"))

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

references/validate.md:745

Temp directory access

after = json.load(open("/tmp/validation_after_recalc.json"))

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

scripts/shared_strings_builder.py:19

Temp directory access

python3 shared_strings_builder.py "A" "B" > /tmp/xlsx_work/xl/sharedStrings.xml

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

scripts/style_audit.py:16

Temp directory access

python3 style_audit.py /tmp/xlsx_work/ # audit an unpacked directory

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

scripts/xlsx_add_column.py:8

Temp directory access

python3 xlsx_add_column.py /tmp/work/ --col G \\

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

scripts/xlsx_insert_row.py:8

Temp directory access

python3 xlsx_insert_row.py /tmp/work/ --at 6 \\

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

Temp directory access

python3 SKILL_DIR/scripts/xlsx_unpack.py input.xlsx /tmp/xlsx_work/

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

Temp directory access

python3 SKILL_DIR/scripts/xlsx_pack.py /tmp/xlsx_work/ output.xlsx

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

Temp directory access

python3 SKILL_DIR/scripts/xlsx_unpack.py input.xlsx /tmp/xlsx_work/

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

Temp directory access

python3 SKILL_DIR/scripts/xlsx_add_column.py /tmp/xlsx_work/ --col G \

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

Temp directory access

python3 SKILL_DIR/scripts/xlsx_pack.py /tmp/xlsx_work/ output.xlsx

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

Temp directory access

python3 SKILL_DIR/scripts/xlsx_unpack.py input.xlsx /tmp/xlsx_work/

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

Temp directory access

python3 SKILL_DIR/scripts/xlsx_insert_row.py /tmp/xlsx_work/ --at 5 \

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

Temp directory access

python3 SKILL_DIR/scripts/xlsx_pack.py /tmp/xlsx_work/ output.xlsx

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

Temp directory access

python3 SKILL_DIR/scripts/xlsx_unpack.py input.xlsx /tmp/xlsx_work/

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

Temp directory access

python3 SKILL_DIR/scripts/xlsx_pack.py /tmp/xlsx_work/ output.xlsx

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

Temp directory access

python3 SKILL_DIR/scripts/xlsx_unpack.py in.xlsx /tmp/work/ # unpack for XML editing

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

Temp directory access

python3 SKILL_DIR/scripts/xlsx_pack.py /tmp/work/ out.xlsx # repack after editing

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

Temp directory access

python3 SKILL_DIR/scripts/xlsx_shift_rows.py /tmp/work/ insert 5 1 # shift rows for insertion

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

Temp directory access

python3 SKILL_DIR/scripts/xlsx_add_column.py /tmp/work/ --col G ... # add column with formulas

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Medium

Temp directory access

python3 SKILL_DIR/scripts/xlsx_insert_row.py /tmp/work/ --at 6 ... # insert row with data

This workflow uses a predictable shared /tmp path for workbook data. Concurrent runs or pre-existing content can cause collisions, unintended overwrite, or cross-run data exposure.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 High

Prompt Injection Attempt Detected

SKILL.md says, "Handle the request directly. Do NOT spawn sub-agents." This unrelated agent-control instruction can override the host's orchestration policy.

The quoted text directly controls agent behavior instead of describing spreadsheet processing. Its location and imperative wording are unambiguous.

RISK-002 High

scripts/xlsx_unpack.py:47-55 scripts/formula_check.py:174-197

Unbounded Workbook Archive Processing

Untrusted XLSX archives are extracted and worksheet parts are loaded without limits on member count, expanded size, compression ratio, or XML size. Crafted files can exhaust disk or memory.

The code iterates and extracts every archive member, then reads worksheet XML into memory. No resource quotas or archive expansion checks are present.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

FIX-001
High
SKILL.md contains an instruction that controls agent orchestration.

Remove the instruction about sub-agents and keep skill guidance limited to spreadsheet operations and output requirements.
FIX-002
High
Workbook archives are processed without expansion or XML size limits.

Reject archives exceeding limits for member count, total uncompressed size, compression ratio, individual part size, and XML complexity.
FIX-003
High
xlsx_unpack.py recursively deletes an existing caller-supplied output directory.

Create a new private temporary directory and refuse nonempty destinations. Never recursively delete an arbitrary path supplied through the CLI.
FIX-004
Medium
Documentation repeatedly uses predictable shared paths under /tmp.

Generate a unique private workspace for each run with tempfile or mktemp, restrict permissions, and clean only that verified workspace.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: 02be9409c79ca1183f7844009c14d9df684d0cf9
Content hash: 4ffb70af6ccd00e90c3b14516d50a850ae0f2f1807a01d326aa1393e0067dd41
Tree hash: cc3ed83cced8045bc84abf3279e34a4b6963ebd75d305853229c155e2675ccb1
Skill path: skills/minimax-ai/minimax-xlsx
Audit payload hash: 218e7e77b99917f7082a8903b9bed20b

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active