Agent skill · security · yaklang
csv-formula-injection
CSV/spreadsheet formula injection (DDE, Excel/LibreOffice, Google Sheets IMPORT*). Use when exports, imports, or user fields feed spreadsheets or reporting tools.
Why this skill is useful
Provides detailed methodologies and examples for executing and defending against CSV formula injection attacks, which are not commonly known.
What it needs
About 2k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: CSV Formula Injection AI LOAD INSTRUCTION: This skill covers formula/DDE-style injection in CSV and spreadsheet contexts, obfuscation, cloud-sheet primitives, and safe testing methodology. Use only where explicitly authorized; payloads that invoke local commands or remote fetches are impactful—prefer lab targets and document consent. Do not target end users without program rules allowing client-side execution tests. 0. QUICK START Characters that may trigger formula evaluation when a cell is opened in Excel, LibreOffice Calc, or similar (often only if the cell is interpreted as a formula): Test cells may look like: Routing note: when testing CSV exports, back-office reports, or user data opened in spreadsheets, prioritize these prefix characters. --- 1. DDE INJECTION (EXCEL / LIBREOFFICE) Dynamic Data Exchange (DDE) and external call patterns historically abused in spreadsheets. Examples for controlled lab reproduction: PowerShell-style chaining (lab only; replace host and payload with benign equivalents): --- 2. OBFUSCATION Defensive parsers may strip obvious patterns; testers may try noise and spacing (still only where allowed): Extra whitespace after =: Dispersed characters / unusual spacing (conceptual pattern—adjust per parser): rundll32 style: --- 3. GOOGLE SHEETS If exported data is later opened in Google Sheets, or sheets pull from untrusted CSV, these functions can cause outbound requests or cross-document data pulls: Data exfiltration / probe (replace URL with your authorized callback): Other high-risk imports: Document which function executed and what network side effects occurred. --- 4. TESTING METHODOLOGY 1. Map sinks — Any feature that emits CSV, XLSX, or tab-separated output: admin exports, audit logs, user rosters, billing reports, search results. 2. Trace user-controlled fields — Profile fields, ticket titles, transaction memos, tags, filenames in ZIP exports—any column that echoes stored input. 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/csv-formula-injection