spreadsheet-analysis
Inspect, profile, clean, reconcile, analyze, visualize, and verify spreadsheet data while preserving formulas, formatting, types, and source files. Use when working with .xlsx, .xlsm, .xls, .ods, .csv, or .tsv files; answering questions from a workbook; auditing formulas or data quality; comparing sheets or versions; producing pivots, charts, forecasts, or summary workbooks; repairing malformed tables; or validating that spreadsheet edits and calculations are accurate.
git clone --depth 1 https://github.com/seb1n/awesome-ai-agent-skills /tmp/spreadsheet-analysis && cp -r /tmp/spreadsheet-analysis/documents-and-files/spreadsheet-analysis ~/.claude/skills/spreadsheet-analysisSKILL.md
# Spreadsheet Analysis Preserve the source workbook, distinguish stored values from formulas, and support every conclusion with reproducible checks. ## Inputs Collect or state: - Source file(s), business question, intended audience, output format, and acceptance criteria. - Relevant sheets/ranges, keys, units, currencies, date/time zones, accounting signs, and reporting period. - Whether formulas, formatting, comments, hidden content, macros, external links, pivots, charts, and protection must remain intact. - Authoritative totals or source systems for reconciliation. - Confidentiality constraints and whether local-only processing is required. Do not guess the meaning of unlabeled fields or ambiguous blanks, zeros, percentages, dates, and IDs. Record assumptions. ## Output contract Return: 1. Source path, hash, format, workbook/sheet inventory, and analysis scope. 2. Findings with metric definition, formula or method, filters, units, period, denominator, and evidence location. 3. Data-quality and formula issues separated from business conclusions. 4. A new output workbook/data file when edits are requested; never silently overwrite the source. 5. Reconciliation, recalculation, re-open, and visual inspection results with limitations. Clearly label calculated, estimated, cached, missing, and externally sourced values. Do not claim a workbook was recalculated if only cached formula results were read. ## Workflow ### 1. Preserve and inventory - Resolve exact paths, calculate source hashes, and work from a copy or new output path. - Do not open untrusted workbooks with macros enabled or refresh external connections. - Run the bundled read-only profiler from this skill directory for CSV, TSV, XLSX, or XLSM inventory: ```bash python3 scripts/profile_table.py /path/to/data.csv --pretty python3 scripts/profile_table.py /path/to/workbook.xlsx --pretty python3 scripts/profile_table.py /path/to/data.csv --output /path/to/profile.json --pretty ``` The script uses the Python standard library, streams logical CSV/TSV records (including quoted multiline fields), applies byte/row/field/member limits, does not calculate formulas, and does not modify the file. It does not emit profiled data-row cell values, but it does emit headers, sheet names, counts, numeric ranges, and structural metadata. With `--output`, it refuses input aliases and non-regular destinations, then atomically creates or replaces the report via a sibling temporary file. A `partial`, `row_limit_reached`, or `skipped_*` status means the inventory is incomplete; review the stated limit instead of treating the profile as a verdict. ### 2. Choose an available toolchain Read [tool-routing.md](references/tool-routing.md). Inventory the installed spreadsheet application, Python/JavaScript libraries, and converters before selecting one. Prefer a workbook-aware engine when formulas, styles, charts, pivots, macros, or named ranges matter. Prefer a dataframe/query engine for tabular analysis after the workbook semantics are understood. Do not install dependencies, upload data, or convert formats without permission. Conversion can lose formulas, formats, macros, dates, comments, charts, or multiple sheets. ### 3. Open or render a baseline Open the original in a trusted spreadsheet application when available. For an untrusted original, require the controls defined in step 8: protected/read-only input, macros/VBA/events/add-ins/DDE disabled, no link/query refresh, and no network. If those controls cannot be verified, retain the static profiler output as partial and stop before application open or recalculation. Capture a visual baseline for every relevant sheet and any dashboard, print layout, chart, or unusual formatting. Inventory: - Visible, hidden, and very-hidden sheets; used ranges; headers; merged cells; tables; filters; freezes; and defined names. - Formulas, cached values, errors, array/spill formulas, circular references, and calculation mode. - External links, data connections, queries, macros, validation rules, comments, and protection. - Units, number formats, date systems, locale assumptions, and blank/null conventions. Treat hidden rows/sheets as in scope for integrity and security, not automatically as analysis data. ### 4. Define the analytical grain Identify what one row represents, the primary key, allowed duplicates, dimensions, measures, period boundaries, and join cardinality. Build a data dictionary for ambiguous columns. Read [analysis-checklist.md](references/analysis-checklist.md) for profiling and reconciliation checks. Create a normalized analysis copy when necessary; retain source row identifiers so every result can be traced back. ### 5. Validate and reconcile before interpreting Check row counts, duplicate keys, missingness, type drift, invalid categories, date gaps, outliers, formula inconsistencies, hidden exclusions, and join multiplication. Reconcile key totals to an authoritative control or explain why no control exists. Inspect formulas as formulas and values separately. Detect hard-coded constants inside formula regions, relative-reference drift, mixed signs, inconsistent ranges, and error suppression. Never replace a formula with a value silently. ### 6. Analyze with explicit definitions State the metric definition before calculating. Use precise filters, denominators, period logic, units, and rounding. Preserve full precision in calculations and round only for presentation. Separate descriptive results from forecasts or causal claims. For forecasts, document horizon, method, training window, seasonality, uncertainty, and backtest performance. ### 7. Create outputs minimally Write only requested changes to a new workbook or table. Preserve formats, formulas, names, hidden state, validations, macros, and charts unless intentionally changed. Use formulas when recipients need an auditable model; use fixed values only when requested and label them. Use [analysis-report-template.md](as
Design reproducible evaluations for AI agents with representative task sets, explicit rubrics, appropriate graders, baselines, regression gates, and failure analysis. Use when defining agent quality, comparing prompts or models, validating a release, measuring tool-use reliability, investigating regressions, or deciding whether an agent is ready for production.
Design privacy-aware observability for AI agents using traces, spans, structured events, metrics, cost attribution, dashboards, alerts, and investigation workflows. Use when instrumenting an agent, debugging intermittent tool or model failures, defining service-level objectives, analyzing latency or spend, auditing agent decisions, or preparing production monitoring.
Design and verify auditable human oversight, approval gates, escalation paths, and safe state transitions for AI agent workflows. Use when deciding which agent actions require review, adding approve/reject or dual-control flows, preventing unauthorized autonomous effects, creating decision records, reducing rubber-stamping, or recovering safely from rejected, expired, or failed actions.
Design, implement, harden, and verify Model Context Protocol (MCP) servers with precise tool contracts, least-privilege authorization, safe transports, structured errors, and interoperability tests. Use when creating a new MCP server, exposing an API or data source through MCP, reviewing an MCP server design, adding or revising MCP tools, or preparing an MCP server for production.
Design and operate bounded multi-agent workflows with task decomposition, dependency graphs, ownership, handoff contracts, shared-state controls, approvals, recovery, and synthesis. Use when a task contains genuinely independent workstreams, specialized roles, parallel research or implementation, reviewer-worker loops, or coordination problems that one agent should not execute sequentially.
Design and validate model-facing tool definitions with clear names, action-oriented descriptions, bounded JSON Schema parameters, explicit side effects, safe defaults, idempotency, errors, and realistic tests. Use when creating function-calling tools, MCP tools, agent actions, structured tool inputs, or when a model selects the wrong tool, invents arguments, or causes unsafe side effects.
Plan, execute, document, and retest authorized security assessments of AI agents and multi-agent workflows using safe adversarial cases, synthetic identities, canaries, and evidence-based findings. Use when defining red-team rules of engagement, assessing prompt injection or excessive agency, testing tool and identity boundaries, evaluating memory or cross-agent attacks, scoring a campaign, or verifying remediation in an approved environment.
Threat-model and harden AI agents, RAG systems, assistants, and tool-using workflows against direct, indirect, stored, cross-agent, and multimodal prompt injection. Use when reviewing an agent architecture, isolating untrusted content, constraining tools and egress, protecting secrets, adding injection-focused tests, investigating a suspected injection incident, or documenting residual prompt-injection risk.