hunting-formula-injection-in-exports SKILL.md skillA
hunting-formula-injection-in-exports from unboundcompute/security-agent-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add unboundcompute/security-agent-skills/hunting-formula-injection-in-exports@git:20260903.6dac719Pins git:20260903.6dac719 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- unboundcompute/security-agent-skills
- Path
skills/hunting-formula-injection-in-exports/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260903.6dac719, committed Sep 3, 2026
- Size
- 9,985 bytes
- Repository stars
- 26
- License
- MIT
Hunt formula injection, also called CSV injection, where an untrusted field stored by the application is later written into an exported CSV, TSV, or spreadsheet and a spreadsheet program evaluates it as a formula when a victim opens the file. A cell whose first character is an equals, plus, minus, or at sign, or a tab or carriage-return prefix, is treated as a formula, so a stored value can call a data connection or hyperlink to exfiltrate other cells, trigger a legacy dynamic-data command…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Hunting formula injection in exports: when a cell runs code on open An application that lets users store text and later offers an export to a spreadsheet format has quietly built a delivery channel. Spreadsheet programs decide whether a cell is data or a formula by its first character: a leading equals, plus, minus, or at sign marks a formula, and so does a leading tab or carriage return that the program strips before parsing. So a value a user typed into a profile field, a comment, or a device name, stored verbatim and written into a downloaded report, becomes live code when an administrator opens that report. The formula can pull other cells out to an attacker URL through a web or hyperlink function, invoke a legacy dynamic-data exchange command that launches a program, or display misleading content the recipient trusts. The bug lives in the export writer, not the input page, and the victim is the person who opens the file. You find it by tracing stored untrusted fields into every export and checking whether dangerous leading characters are neutralized. ## When to use - The application exports user-controlled data to CSV, TSV, or a spreadsheet workbook format. …
Read the whole file at its exact version.
How to install
mdr add unboundcompute/security-agent-skills/hunting-formula-injection-in-exports@sha256:fe1ac0bdcacf6d6fThe line at the top of this page pins the label git:20260903.6dac719, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_b5dy43sekbkehm75)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Sep 3, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (9985 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
unboundcompute/security-agent-skills · 26 stars · license MIT · pushed 2026-09-08 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_b5dy43sekbkehm75 GET https://markdownregistry.com/api/v1/resolve?ref=unboundcompute/security-agent-skills/hunting-formula-injection-in-exports GET https://markdownregistry.com/api/v1/blob/fe1ac0bdcacf6d6fd91e7babe6c35009b052332fc83438e3e7d3e1ca43ac7d08
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.