csv-formula-injection

Name: csv-formula-injection
Availability: InStock
Author: Prohao42

Detect and mitigate spreadsheet formula injection risks in CSV workflows.

120|8|Updated Jun 2, 2026

Search Tags:#spreadsheet #csv #google-sheets #security-testing #data-validation #formula-injection

Ready to run

npx skills add https://github.com/Prohao42/aimy-sikll --skill csv-formula-injection-prohao42

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: csv-formula-injection
Source: https://github.com/Prohao42/aimy-sikll/tree/main/ai-mian/hack-skills/skills/csv-formula-injection
Command: npx skills add https://github.com/Prohao42/aimy-sikll --skill csv-formula-injection-prohao42

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

CSV/spreadsheet formula injection (DDE, Excel/LibreOffice, Google Sheets IMPORT*). Use when exports, imports, or user fields feed spreadsheets or reporting tools.

Core Features & Use Cases

Vulnerability discovery: Identify DDE and external-call injection vectors in spreadsheets exported as CSV or imported into Excel, LibreOffice, or Google Sheets.
Safe testing methodology: Provide lab-safe patterns and guidance to test formula evaluation without risking systems.
Defense guidance: Recommend encoding, escaping, and validation techniques to prevent inadvertent formula execution.
Use case: Data pipelines exporting user data to CSV and dashboards relying on spreadsheet tools.

Quick Start

Test a sample CSV containing a cell with =1+1 to observe evaluation and apply the recommended defenses.

Frequently Asked Questions about csv-formula-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What is spreadsheet formula injection in CSV exports?▼

Spreadsheet formula injection occurs when CSV data containing formulas executes automatically in Excel, LibreOffice, or Google Sheets. It happens when user-supplied data containing characters like = or + triggers DDE commands or external calls upon import.

How do I prevent CSV formula injection in data pipelines?▼

Prevent CSV formula injection by applying encoding, escaping, and data validation techniques to sanitize user fields before export. This neutralizes malicious characters in data pipelines, ensuring spreadsheets do not execute inadvertent formulas.

How do I test spreadsheet formula injection safely?▼

Test spreadsheet formula injection safely by applying lab-safe testing patterns with sample cells like =1+1. This identifies DDE and external-call injection vectors in isolated CSV exports without risking production systems.

Does Google Sheets support DDE formula injection from CSV imports?▼

Yes, Google Sheets supports formula injection risks through IMPORT* functions when importing CSV files. It evaluates malicious formulas if user fields are not properly validated and escaped before entering the spreadsheet workflow.

Why does Excel execute formulas when opening a CSV file?▼

Excel executes formulas when opening a CSV file because it automatically evaluates cells starting with characters like = as formulas or DDE commands. Without proper escaping or encoding during export, this leads to inadvertent formula execution.

What are the limitations of data validation for preventing formula injection?▼

Data validation limitations include the challenge of sanitizing all dangerous prefixes like =, +, -, and @ across diverse user inputs. Escaping and encoding must be applied consistently across all data pipelines to prevent external calls and DDE injection effectively.