csv-formula-injection

Name: csv-formula-injection
Availability: InStock
Author: Bingo

Detect CSV and spreadsheet formula injection vulnerabilities across Excel, LibreOffice Calc, and Google Sheets.

Updated Aug 23, 2026

Search Tags:#spreadsheet #csv #security assessment #injection testing #formula injection

Ready to run

npx skills add https://github.com/bingook/bingo --skill csv-formula-injection-bingook

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: csv-formula-injection
Source: https://github.com/bingook/bingo/tree/main/bingo/skills/hack-skills/csv-formula-injection
Command: npx skills add https://github.com/bingook/bingo --skill csv-formula-injection-bingook

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the process of testing for CSV and spreadsheet formula injection vulnerabilities, streamlining security assessments.

Core Features & Use Cases

CSV Formula Injection Testing: Identifies vulnerabilities in CSV and spreadsheet data handling.
Spreadsheet Software Support: Works with Excel, LibreOffice Calc, and Google Sheets.
Use Case: Quickly assess the security of CSV exports and user data before they are opened in spreadsheets, detecting potential DDE injection, XSS, and other security issues.

Quick Start

Use the csv-formula-injection skill to test for formula injection vulnerabilities in the CSV export from 'user_data.csv'.

Frequently Asked Questions about csv-formula-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test CSV exports for spreadsheet formula injection vulnerabilities?▼

To test CSV exports for spreadsheet formula injection, you can automate security assessments using controlled payloads to detect DDE injection, XSS, and data exfiltration risks before user data is opened in spreadsheet applications.

What is CSV formula injection and how does it affect spreadsheet security?▼

CSV formula injection is a security vulnerability where malicious formulas embedded in CSV exports execute commands or exfiltrate data when opened in spreadsheet software. This automated testing detects DDE injection and XSS vulnerabilities across major platforms.

Does this formula injection testing work with Google Sheets and LibreOffice Calc?▼

Yes, this formula injection testing supports Google Sheets and LibreOffice Calc, alongside Microsoft Excel. It assesses CSV data handling across these spreadsheet platforms to identify potential DDE injection and cross-site scripting vulnerabilities.

How do I safely test for DDE injection in CSV files without causing harmful effects?▼

You can safely test for DDE injection in CSV files by using controlled payloads and safe testing methodologies. This approach identifies spreadsheet security vulnerabilities while preventing harmful command execution or data exfiltration during the security assessment.

Why does opening a CSV export in Excel trigger a formula injection warning?▼

Opening a CSV export in Excel triggers a formula injection warning because unescaped user data containing special characters like equals signs is interpreted as executable formulas. This testing identifies such data handling vulnerabilities before the files are distributed.