excelize

Least-privilege permissions

• Restrict agent to read-only mode by default; require explicit approval workflows for write operations
• Limit file access to designated directories; deny access to system paths and shared credential stores
• Apply OS-level file permissions (e.g., chmod 640) so only the agent process owner can read/write Excel files
• Implement role-based access control (RBAC) at the application layer; different agents/users should access only their assigned workbooks

Network isolation

• Run the excelize agent in an isolated container or VM with no outbound internet access unless explicitly required for file retrieval
• Disable external data source refresh (e.g., OLE links, XML maps) in excelize to prevent automatic data fetching from untrusted URLs
• Block DNS resolution and HTTP requests from the agent process to prevent data exfiltration via cell formulas or metadata
• Use a local-only file server (not cloud-synced) for spreadsheet storage if sensitive data is involved

Monitoring

• Log all file read/write operations with timestamps, file paths, and data checksums; alert on suspicious patterns (bulk exports, overwrites)
• Monitor CPU and memory spikes during parsing; malformed files or zip bombs can trigger DoS; set resource limits (timeout, max file size)
• Audit LLM prompt injection: log all cell content passed to prompts and flag cells containing formula syntax (=, @, +, -) or control characters
• Track excelize library version and security advisories; establish automated dependency scanning (e.g., go list -m all) in CI/CD

Red flags to watch for

• Agent attempts to read/write files outside designated directories or modifies file permissions
• Spreadsheet cells containing formulas with external references (=WEBSERVICE(), =QUERY()) or macro-like syntax
• Sudden large-scale file modifications or deletions; agent writing to protected workbooks
• Parsing failures, timeouts, or excessive resource consumption; may indicate zip bomb or intentional resource exhaustion attack