SR
SKILLRADAR
AI Security • Benchmarking • Index
Menu⌄
Trust Report v1

xlsx

Use this skill any time a spreadsheet file is the primary input or output. This means any task where the user wants to: open, read, edit, or fix an existing .xlsx, .xlsm, .xltx, .csv, or .tsv file (e.g., adding columns, computing formulas, formatting, charting, cleaning messy dat

Overall
73
Trust
57
Utility
88
Momentum
82

Install caution

High-risk behavior present

Risk: High

Source: Anthropic Skills

Path: skills/xlsx/SKILL.md

Review flags: filesystem/home-directory access, package installation commands, shell command snippets. These are review signals, not definitive security judgments; inspect before installing.

Required permissions

  • • Environment variables / secrets
  • • Shell commands
  • • Filesystem/home access

Permissions are inferred from SKILL.md text only. They are review prompts, not guarantees about runtime behavior.

Risk flags explained

filesystem_write_or_home_accessmedium

Mentions filesystem writes, deletes, home-directory paths, or config/key locations.

package_installmedium

Mentions package installation or dependency-fetching commands.

shell_commandmedium

Contains shell command snippets. Review commands before copy/paste or agent execution.

Score explanation

Trust

  • • Trust starts at 90 before review-signal penalties and metadata bonuses.
  • • Risk-signal penalty: -35 from 3 detected flag(s).
  • • Metadata bonus: +2 from author/version/description fields.

Utility

  • • Utility starts at 55 and rewards clear descriptions, runnable examples, and explicit setup needs.
  • • Description present: yes.
  • • Command examples detected: 3.
  • • Environment variables detected: 1.

Momentum

  • • Momentum starts at 45 and uses public repo activity signals.
  • • Recent repo update within 13 days.
  • • Recent commit volume: 3 commit(s) in the lookback window (+9).
  • • Source has strong public adoption: 166866 stars.
  • • Fork activity suggests reuse: 19880 forks.

Overall

  • • Overall score weights trust 45%, utility 35%, and momentum 20%.

Detected signals

Env vars

  • • API

Commands

  • • (pip, preinstalled — install only if an import fails or the command is missing) · LibreOffice (
  • • pip install
  • • python scripts/recalc.py output.xlsx [timeout_seconds] # default 30

URLs

None detected in SKILL.md text scan.

Provenance & evidence

SkillRadar makes each review traceable back to the exact source path, source blob SHA, scanner version, and text-only policy that produced the report.

source
github.com/anthropics/skills@main
path
skills/xlsx/SKILL.md
source blob SHA
9da54804cc8c938586f89363c8da3b3a6e2a563d
scanner version
0.3.0
security model
text_only_no_execute_no_install_no_secrets
scan policy
Fetched and scored as text only; no install, no execution, no runtime loading.

Evidence snippets

filesystem_write_or_home_access

…`openpyxl`, `pandas`, and `markitdown` are preinstalled — do not run `pip install` first; write the script and import directly. Only if an import fails (or the `markitdown` command is m…

package_install

…— see gotchas | > `openpyxl`, `pandas`, and `markitdown` are preinstalled — do not run `pip install` first; write the script and import directly. Only if an import fails (or the `markitdown…

shell_command

…s — see gotchas | > `openpyxl`, `pandas`, and `markitdown` are preinstalled — do not run `pip install` first; write the script and import directly. Only if an import fails (or the `markitdown`…

Watch this skill

Get alerted when this skill adds credential requirements, shell commands, external domains, remote installer patterns, or risk-level changes.

Join watchlist beta

Methodology note

SkillRadar scans SKILL.md as hostile text only. It does not execute commands, install packages, or load third-party skills.

View source SKILL.mdBack to changesView sources