skills.rest
DorianGallo
DorianGalloCOMMUNITY
Explore all skills by this author →
GitHub

csv-formula-injection

Detect and mitigate CSV formula injection in spreadsheet exports.

5|2|Updated May 16, 2026
Search Tags:#sanitization#Google Sheets#csv#formula injection#spreadsheet security#DDE#export validation
One-click install
npx skills add https://github.com/DorianGallo/hack-skills-local --skill csv-formula-injection-doriangallo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: csv-formula-injection
Source: https://github.com/DorianGallo/hack-skills-local/tree/main/skills/csv-formula-injection
Command: npx skills add https://github.com/DorianGallo/hack-skills-local --skill csv-formula-injection-doriangallo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

CSV exports and spreadsheet imports can be abused when user-controlled fields are interpreted as formulas, enabling DDE-style execution patterns and high-risk data pull behaviors in Excel, LibreOffice Calc, or Google Sheets.

Core Features & Use Cases

  • Formula-trigger probing: Identify whether exported CSV fields are evaluated when opened as spreadsheets by trying common formula-leading characters and benign arithmetic signals.
  • DDE and spreadsheet execution patterns: Reproduce historically abused DDE-style call patterns (lab-controlled) and understand how cells may invoke external interactions.
  • Google Sheets import primitives: Assess whether sheet-based imports like IMPORTXML/IMPORTRANGE/IMPORTHTML can trigger outbound requests or cross-document reads when opening untrusted CSV-fed data.
  • Defense guidance: Reduce risk by neutralizing leading triggers, forcing text interpretation, and sanitizing export pipelines before spreadsheet opening.

Quick Start

Use the csv-formula-injection skill to assess whether a given CSV export can trigger formula evaluation when opened in the spreadsheet app, starting with benign tests and documenting observed behavior.

Frequently Asked Questions about csv-formula-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent CSV formula injection in spreadsheet exports?▼

CSV formula injection occurs when user-controlled fields are evaluated as formulas during spreadsheet import, enabling DDE-style execution patterns and high-risk outbound data pulls in Excel, LibreOffice Calc, or Google Sheets.

How do I test if my CSV export triggers formula evaluation in Excel or Google Sheets?▼

Google Sheets import primitives like IMPORTXML, IMPORTRANGE, and IMPORTHTML can trigger outbound requests or cross-document reads when opening untrusted CSV-fed data, posing a significant spreadsheet security risk.

What is the best way to sanitize user-controlled CSV fields before spreadsheet import?▼

DDE-style execution patterns allow spreadsheet cells to invoke external interactions, meaning malicious CSV fields can execute commands or pull external data when opened in applications like LibreOffice Calc or Excel.

Do I need special tools to mitigate DDE-style execution in CSV files?▼

Export validation limits include the need to cover DDE-style trigger understanding and Google Sheets IMPORT* behavior, requiring continuous sanitization of export pipelines to ensure text-forcing defenses hold across different spreadsheet applications.

Related Skills

Explore More Data & Analytics Skills→
shalevaminshalevamin

spreadsheet

Create, edit, analyze, and format .xlsx, .csv, and .tsv spreadsheet files.

Community
Intermediate
sayseven7sayseven7
11

csv-formula-injection

Detect spreadsheet formula injection risks in CSV export workflows.

Community
Intermediate
langbyyilangbyyi
96

csv-formula-injection

Detect CSV and spreadsheet formula injection vulnerabilities in exported files.

Community
Intermediate
lNwNllNwNl
2

csv-formula-injection

Detect and document CSV-to-spreadsheet formula injection vectors for SLDA.

Community
Intermediate