Agent Skill · Anthropic
Excel (xlsx) skill
Anthropic's published skill for reading, analysing and generating Excel workbooks, using bundled scripts for deterministic spreadsheet operations.
This skill bundles executable code. Scripts shipped alongside the instructions run with the permissions of the engineer running the agent. Review the scripts, not only the SKILL.md.
What it is, and what it costs you
Spreadsheets are where a language model's weaknesses and a script's strengths diverge most sharply. Asking a model to reason its way through a large workbook is slow, expensive in context, and unreliable on exactly the arithmetic it looks most confident about. Handing the workbook to code that reads cells, evaluates ranges and writes results is deterministic and cheap. This skill encodes that division of labour.
The governance angle is less about the code and more about what the code is pointed at. Spreadsheets in a business are where the sensitive data that never made it into a governed system lives — salary models, customer lists, forecasts, board material, pricing. An agent with a working Excel skill and filesystem access is an efficient reader of all of it, and every cell it reads becomes context that goes wherever that session goes.
Formulas add a second dimension. A workbook can contain external references and links that pull data from other locations when evaluated, so 'read this spreadsheet' is not necessarily a self-contained operation. A workbook received from outside the organisation should be treated as untrusted input, not as a data file.
The context cost is worth planning for too: a large workbook rendered into text can consume an enormous share of the window, which is precisely why the script-based approach — extract what is needed, summarise the rest — is the right shape.
Capability profile
What this skill can reach inside your environment, and why a security team cares. Derived from the publisher's documentation, not from a scan.
- bundled script execution
Runs with the invoking user's permissions, using spreadsheet libraries against whatever file is supplied.
- sensitive data read
Spreadsheets concentrate ungoverned sensitive data. Everything read enters the context window.
- workbook write
Generated or modified workbooks are written to the filesystem and may be distributed onward as authoritative.
- external reference evaluation
Formulas can reference external locations, so reading is not always a self-contained operation.
Before you distribute this to a team
- Constrain which directories the agent can reach
The skill is only as exposed as the filesystem scope around it. Keep finance and HR directories out of allowed paths.
- Treat externally-sourced workbooks as untrusted
External references and embedded content make a received workbook active input, not passive data.
- Review and pin the bundled scripts
Same discipline as any dependency: read the code once, pin the version, re-review on change.
Vincosha Assay assessment
not yet assessedWe have not published a scan verdict for Excel (xlsx) skill.
Everything above is a capability profile compiled by hand from the publisher's own public documentation on 2026-07-25. It describes what this artifact can reach and what to restrict before rolling it out. It is not a security verdict, and it should not be read as one.
When Vincosha Assaypublishes an assessment for this artifact it will appear here with a verdict, the findings behind it, and the date it ran. We would rather leave this space empty than fill it with a guess — inventing a security verdict about somebody else's software would be both wrong and dangerous.
What an assessment covers
- prompt-injection patterns in descriptions and instructions
- credential reads and outbound egress in bundled code
- over-scoped permissions and manifest claims
- typosquatted and impersonating names
- tool-manifest drift since the last approval
- content hash against the version you approved
Sources
Compiled from the publisher's own documentation and repository. Skills change — read the version you are about to install rather than trusting a profile.