Agent Economy ReportAgent Economy ReportSAFE version 1.0.2 · audited 2026-09-09
This package is documentation only: it contains a markdown guidance file with best-practice rules for working with Excel/XLSX files, a small metadata file, and a descriptive skill card. There is no executable code, no scripts, no network calls, and no file writes. The only external references are the publisher's own website links and a suggestion to install related skills via the `clawhub` command-line tool if the user confirms. The advice itself (use pandas or openpyxl, watch out for date serial numbers, preserve templates, recalculate before delivery) is conventional and matches the stated purpose. Nothing in the package attempts to access credentials, spend money, or override an agent's other rules.
| Declared purpose | Provide guidance for creating, inspecting, and editing Microsoft Excel workbooks and XLSX/CSV files reliably, covering formulas, dates, data types, formatting, recalculation, and template preservation. |
| Observed behavior | Purely advisory text. It instructs the agent to prefer certain Python libraries and to follow spreadsheet-handling conventions. It mentions optional `clawhub install <slug>` for three related skills (gated on user confirmation) and optional `clawhub star`/`clawhub sync` feedback commands. No code executes, no data leaves the machine, no files are modified by the package itself. |
| Verdict, rules only | SAFE |
| Verdict, AI | SAFE |
| Final verdict | SAFE (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| filesystem_read | needed | The guidance implies reading spreadsheet files (.xlsx, .xlsm, .xls, .csv, .tsv) that the user asks about; no read is hardcoded in the package. |
| filesystem_write | needed | Editing and saving workbooks is inherent to the declared purpose; the package contains no write operations of its own (deterministic scan found zero file writes). |
| install_packages | exceeds purpose | SKILL.md line 95 suggests `clawhub install <slug>` for three related skills, explicitly conditioned on user confirmation. Low risk but it is an install suggestion beyond the core purpose. |
| other | exceeds purpose | Lines 102-103 suggest running `clawhub star excel-xlsx` and `clawhub sync`, promotional/registry commands unrelated to spreadsheet work. |
| severity | finding |
|---|---|
| info | Suggests installing additional skills Recommends three related skills be installed through the ClawHub registry, but explicitly requires user confirmation first. No automatic installation occurs and no package manager or shell command is executed by the package. SKILL.md:95 Install with `clawhub install <slug>` if user confirms: |
| info | Self-promotional registry command Encourages the agent or user to run a registry 'star' command and `clawhub sync` (line 103). These are unrelated to the spreadsheet purpose but harmless: no credentials or data are involved. SKILL.md:102 - If useful: `clawhub star excel-xlsx` |
| info | External homepage link A publisher homepage URL appears in metadata. It is a passive reference; nothing in the package fetches from it. SKILL.md:5 homepage: https://clawic.com/skills/excel-xlsx |
| info | Publisher profile link Passive link to the publisher's registry profile. No network activity is performed by the package. skill-card.md:7 [ivangdavila](https://clawhub.ai/user/ivangdavila) <br> |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:7 |
| clawic.com | not in the service index | SKILL.md:5 |
| Binaries invoked | none |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 103 | 52421d9fba8fdb64… |
_meta.json | 6 | df7eca48e929051d… |
skill-card.md | 41 | 262cf2061eaf91d1… |
For agents
JSON: https://agenteconomy.report/k/excel-xlsx.audit.json · badge: https://agenteconomy.report/k/excel-xlsx.audited.svg ·
skill rating: /k/excel-xlsx · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).