skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

csv-formula-injection

Detect and document CSV-to-spreadsheet formula injection vectors for SLDA.

2|Updated May 15, 2026
Search Tags:#security testing#spreadsheet#excel#csv#google sheets#formula injection#dde
One-click install
npx skills add https://github.com/lNwNl/Methodos --skill csv-formula-injection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: csv-formula-injection
Source: https://github.com/lNwNl/Methodos/tree/main/docker/opencode/skills/csv-formula-injection
Command: npx skills add https://github.com/lNwNl/Methodos --skill csv-formula-injection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps you assess whether CSV or spreadsheet exports can be manipulated so that spreadsheet software evaluates attacker-controlled cell contents as formulas or DDE/external-call primitives.

Core Features & Use Cases

  • Identify spreadsheet sinks: Focuses on where exported CSV/XLSX/TSV and user-controlled fields flow into Excel, LibreOffice Calc, or Google Sheets (including IMPORT* functions).
  • Design controlled reproduction tests: Covers formula-trigger prefixes (e.g., =, +, -, @), DDE patterns for Excel/LibreOffice, and Google Sheets import probes using authorized endpoints.
  • Validate and document evidence safely: Emphasizes authorized testing, observing whether evaluation/warnings occur, and capturing product/version details to support remediation.
  • Use-case example: When user fields (like names, memos, or tags) are exported to an administrative CSV report and then opened in Excel, you can verify whether crafted values trigger formula evaluation and external behaviors.

Quick Start

Ask an AI to generate authorized, harmless test CSV rows for detecting spreadsheet formula evaluation and outline the exact evidence to capture when the file is opened in Excel, LibreOffice Calc, or Google Sheets.

Frequently Asked Questions about csv-formula-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for CSV formula injection in spreadsheet exports?▼

Test for CSV formula injection by injecting crafted values with formula-trigger prefixes like =, +, -, or @ into user-controlled fields, then exporting to CSV/XLSX and observing if Excel, LibreOffice Calc, or Google Sheets evaluates them upon opening.

What is spreadsheet formula injection and how does DDE execution work?▼

Spreadsheet formula injection occurs when spreadsheet software evaluates attacker-controlled cell contents as formulas or DDE external-call primitives. DDE execution patterns exploit dynamic data exchange protocols to trigger external behaviors when the exported file is opened.

How do I prevent Google Sheets IMPORT* side effects in exported CSV files?▼

Prevent Google Sheets IMPORT* side effects by validating whether user-controlled fields rendered into spreadsheet views trigger import probes. Security testing of export pipelines identifies these injection pathways so you can sanitize inputs before rendering.

Can I use formula injection testing for LibreOffice Calc and Excel export pipelines?▼

Yes, formula injection testing applies to security testing of export pipelines across Excel, LibreOffice Calc, and Google Sheets. It validates whether crafted values in exported CSV/XLSX/TSV files trigger formula evaluation and external behaviors in these applications.

What evidence should I collect when testing spreadsheet formula injection risks?▼

When testing spreadsheet formula injection risks, collect evidence by capturing product and version details, observing whether formula evaluation or security warnings occur, and documenting authorized test results to support remediation of the export pipeline.

Why does Excel evaluate user-controlled fields as formulas in CSV reports?▼

Excel evaluates user-controlled fields as formulas in CSV reports because spreadsheet applications interpret certain prefixes like =, +, -, or @ as formula triggers. When exported CSV files contain these characters, the software automatically executes the embedded formula upon opening.

Related Skills

Explore More Legal & Compliance Skills→
DorianGalloDorianGallo
5

csv-formula-injection

Detect and mitigate CSV formula injection in spreadsheet exports.

Community
Intermediate
sayseven7sayseven7
11

csv-formula-injection

Detect spreadsheet formula injection risks in CSV export workflows.

Community
Intermediate
rangerrick337rangerrick337
10

xlsx

Automate Excel spreadsheet creation, editing, and analysis with formula integrity across .xlsx, .xlsm, .csv, and .tsv.

Community
Advanced
langbyyilangbyyi
96

csv-formula-injection

Detect CSV and spreadsheet formula injection vulnerabilities in exported files.

Community
Intermediate