Agent skill · Audited from source

minimax-xlsx

skill · minimax-ai/skillsMIT licenceAudited 29 Oct 2026 · source ceddde63e832

★ 13,738pushed 193 days agoversion 1.0
✕BLOCKGrade D · 69/100 · 4 findings · ceddde6
13,738repo stars · whole minimax-ai/skills

Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit ceddde63e832 and observed filesystem access and no hard-coded secrets. The audit raised 4 findings, 2 critical or high. What it does: Open, create, read, analyze, edit, or validate Excel/spreadsheet files (.xlsx, .xlsm, .csv, .tsv). Use when the user asks to create, build, modify, analyze, read, validate, or format any Excel spreadsheet, financial…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “minimax-xlsx (minimax-ai/skills)”. Retrieved 29 Oct 2026. https://modelsatlas.com/skills/minimax-ai/minimax-xlsx

Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 2 critical or high findings, starting with “Privilege escalation / persistence” in scripts/libreoffice_recalc.py:92. Do not install it without reading them.

3 skills are called “minimax-xlsx”. You are viewing minimax-ai/skills. 2 of them are BLOCK.

Trust audit

Audit 0.4.1 · source read 29 Oct 2026

Trust score69/100✕BLOCK D
0 critical2 high1 medium1 low0 info

BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 642 of 14,816 audited skills.

What the source does

  • FilesystemDeclared3 observations
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS1
L1 Static sourceSecrets, path traversal, supply chain, hidden codeFAIL2
L2 InstructionsPrompt injection, authority framing, hidden directivesWARN1
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (4)

HIGHPrivilege escalation / persistencepriv.escalate · scripts/libreoffice_recalc.py:92
F-06 Privilege escalation / persistenceCWE-269 · CWE-250Layer L1
"  Linux:  sudo apt-get install -y libreoffice"
Why
asks for elevated privileges
Fix
—
HIGHPrivilege escalation / persistencepriv.escalate · scripts/libreoffice_recalc.py:212
F-06 Privilege escalation / persistenceCWE-269 · CWE-250Layer L1
print("  Linux:  sudo apt-get install -y libreoffice")
Why
asks for elevated privileges
Fix
—
MEDIUMPrompt injectionscope.undeclared_system · <declared scope>
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
system use found in code, not declared in the description
Why
the description does not admit a capability the code has
Fix
declare system use in the description, or remove it
LOWInventory / provenanceinv.hidden_file · templates/minimal_xlsx/_rels/.rels
F-13 Inventory / provenanceCWE-1104Layer L0
.rels
Why
hidden member outside the usual dotfiles
Fix
review its purpose

Audit 0.4.1 · source sha ceddde63e832 · 29 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherminimax-ai GitHub organizationOwner of the repository this skill is read from
  • Source folderminimax-ai/skills/skills/minimax-xlsxThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdictceddde63e832A new audit runs when the source changes
  • Repository statusNot archivedLast push 193 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Open, create, read, analyze, edit, or validate Excel/spreadsheet files (.xlsx, .xlsm, .csv, .tsv). Use when the user asks to create, build, modify, analyze, read, validate, or format any Excel spreadsheet, financial…

---
name: minimax-xlsx
description: "Open, create, read, analyze, edit, or validate Excel/spreadsheet files (.xlsx, .xlsm, .csv, .tsv). Use when the user asks to create, build, modify, analyze, read, validate, or format any Excel spreadsheet, financial model, pivot table, or tabular data file. Covers: creating new xlsx from scratch, reading and analyzing existing files, editing existing xlsx with zero format loss, formula recalculation and validation, and applying professional financial formatting standards. Triggers on 'spreadsheet', 'Excel', '.xlsx', '.csv', 'pivot table', 'financial model', 'formula', or any request to produce tabular data in Excel format."
license: MIT
metadata:
  version: "1.0"
  category: productivity
  sources:
    - ECMA-376 Office Open XML File Formats
    - Microsoft Open XML SDK documentation
---

# MiniMax XLSX Skill

Handle the request directly. Do NOT spawn sub-agents. Always write the output file the user requests.

## Task Routing

| Task | Method | Guide |
|------|--------|-------|
| **READ** — analyze existing data | `xlsx_reader.py` + pandas | `references/read-analyze.md` |
| **CREATE** — new xlsx from scratch | XML template | `references/create.md` + `references/format.md` |
| **EDIT** — modify existing xlsx | XML unpack→edit→pack | `references/edit.md` (+ `format.md` if styling needed) |
| **FIX** — repair broken formulas in existing xlsx | XML unpack→fix `<f>` nodes→pack | `references/fix.md` |
| **VALIDATE** — check formulas | `formula_check.py` | `references/validate.md` |

## READ — Analyze data (read `references/read-analyze.md` first)

Start with `xlsx_reader.py` for structure discovery, then pandas for custom analysis. Never modify the source file.

**Formatting rule**: When the user specifies decimal places (e.g. "2 decimal places"), apply that format to ALL numeric values — use `f'{v:.2f}'` on every number. Never output `12875` when `12875.00` is required.

**Aggregation rule**: Always compute sums/means/counts directly from the DataFrame column — e.g. `df['Revenue'].sum()`. Never re-derive column values before aggregation.

## CREATE — XML template (read `references/create.md` + `references/format.md`)

Copy `templates/minimal_xlsx/` → edit XML directly → pack with `xlsx_pack.py`. Every derived value MUST be an Excel formula (`<f>SUM(B2:B9)</f>`), never a hardcoded number. Apply font colors per `format.md`.

## EDIT — XML direct-edit (read `references/edit.md` first)

**CRITICAL — EDIT INTEGRITY RULES:**
1. **NEVER create a new `Workbook()`** for edit tasks. Always load the original file.
2. The output MUST contain the **same sheets** as the input (same names, same data).
3. Only modify the specific cells the task asks for — everything else must be untouched.
4. **After saving output.xlsx, verify it**: open with `xlsx_reader.py` or `pandas` and confirm the original sheet names and a sample of original data are present. If verification fails, you wrote the wrong file — fix it before delivering.

Never use openpyxl round-trip on existing files (corrupts VBA, pivots, sparklines). Instead: unpack → use helper scripts → repack.

**"Fill cells" / "Add formulas to existing cells" = EDIT task.** If the input file already exists and you are told to fill, update, or add formulas to specific cells, you MUST use the XML edit path. Never create a new `Workbook()`. Example — fill B3 with a cross-sheet SUM formula:
```bash
python3 SKILL_DIR/scripts/xlsx_unpack.py input.xlsx /tmp/xlsx_work/
# Find the target sheet's XML via xl/workbook.xml → xl/_rels/workbook.xml.rels
# Then use the Edit tool to add <f> inside the target <c> element:
#   <c r="B3"><f>SUM('Sales Data'!D2:D13)</f><v></v></c>
python3 SKILL_DIR/scripts/xlsx_pack.py /tmp/xlsx_work/ output.xlsx
```

**Add a column** (formulas, numfmt, styles auto-copied from adjacent column):
```bash
python3 SKILL_DIR/scripts/xlsx_unpack.py input.xlsx /tmp/xlsx_work/
python3 SKILL_DIR/scripts/xlsx_add_column.py /tmp/xlsx_work/ --col G \
    --sheet "Sheet1" --header "% of Total" \
    --formula '=F{row}/$F$10' --formula-rows 2:9 \
    --total-row 10 --total-formula '=SUM(G2:G9)' --numfmt '0.0%' \
    --border-row 10 --border-style medium
python3 SKILL_DIR/scripts/xlsx_pack.py /tmp/xlsx_work/ output.xlsx
```
The `--border-row` flag applies a top border to ALL cells in that row (not just the new column). Use it when the task requires accounting-style borders on total rows.

**Insert a row** (shifts existing rows, updates SUM formulas, fixes circular refs):
```bash
python3 SKILL_DIR/scripts/xlsx_unpack.py input.xlsx /tmp/xlsx_work/
# IMPORTANT: Find the correct --at row by searching for the label text
# in the worksheet XML, NOT by using the row number from the prompt.
# The prompt may say "row 5 (Office Rent)" but Office Rent might actually
# be at row 4. Always locate the row by its text label first.
python3 SKILL_DIR/scripts/xlsx_insert_row.py /tmp/xlsx_work/ --at 5 \
    --sheet "Budget FY2025" --text A=Utilities \
    --values B=3000 C=3000 D=3500 E=3500 \
    --formula 'F=SUM(B{row}:E{row})' --copy-style-from 4
python3 SKILL_DIR/scripts/xlsx_pack.py /tmp/xlsx_work/ output.xlsx
```
**Row lookup rule**: When the task says "after row N (Label)", always find the row by searching for "Label" in the worksheet XML (`grep -n "Label" /tmp/xlsx_work/xl/worksheets/sheet*.xml` or check sharedStrings.xml). Use the actual row number + 1 for `--at`. Do NOT call `xlsx_shift_rows.py` separately — `xlsx_insert_row.py` calls it internally.

**Apply row-wide borders** (e.g. accounting line on a TOTAL row):
After running helper scripts, apply borders to ALL cells in the target row, not just newly added cells. In `xl/styles.xml`, append a new `<border>` with the desired style, then append a new `<xf>` in `<cellXfs>` that clones each cell's existing `<xf>` but sets the new `borderId`. Apply the new style index to every `<c>` in the row via the `s` attribute:
```xml
<!-- In xl/styles.xml, append to <borders>: -->
<border>
  <left/><

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit ceddde6

git clone https://github.com/minimax-ai/skills
git -C skills checkout ceddde63e832

The author documents no install command, so this uses the repository directly. Our verdict covers commit ceddde63e832 only.

Works in

The author has not said which agents this skill supports, and we have not tested it in any.

Audit history

Every audit, every source change

  1. ✕BLOCK D 69 / 100

    first audit · source ceddde63e832

README badge

For maintainers · shows the latest audit

ModelsAtlas: BLOCK DMODELSATLASBLOCK · D
[![ModelsAtlas: BLOCK D](https://modelsatlas.com/skills/minimax-ai/minimax-xlsx/badge.svg)](https://modelsatlas.com/skills/minimax-ai/minimax-xlsx/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Similar skills

Add this badge to your README

[![ModelsAtlas: BLOCK D](https://modelsatlas.com/skills/minimax-ai/minimax-xlsx/badge.svg)](https://modelsatlas.com/skills/minimax-ai/minimax-xlsx/)

Questions about minimax-xlsx

Is minimax-xlsx safe to install?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What can minimax-xlsx access on my machine?
The audit observed that it reads or writes files. Each of those is consistent with what it says it does. Secrets in the source: none found.
How current is this page?
The grade is for one exact copy of the source (ceddde63e832), read on 2026-10-29. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.