excel-addin-debugging — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited excel-addin-debugging (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Trigger this skill when any of the following apply:
Office.context, Excel.run, or requirement sets (ExcelApi, DialogApi, etc.).http://localhost:9222 is an Excel add-in rather than a generic web page.For generic DOM/CDP interaction against the WebView2 target (snapshot, click, screenshot), defer to the excel-webview2 skill.
Call excel_context_info before any Office.js-aware tool. If it returns hasOfficeGlobal: false, stop and report the target is not an Excel add-in — subsequent Office.js tools will fail.
The tool returns:
hasOfficeGlobal, hasExcelGlobal — presence of the runtime globals.hostInfo — { host, platform, version } from Office.context.diagnostics.contentLanguage, displayLanguage — locale info.requirementSets — which ExcelApi / DialogApi / SharedRuntime / ExcelApiOnline / RibbonApi / IdentityAPI versions the host supports.Branch behavior on requirementSets. For example, only call getItemOrNullObject patterns if ExcelApi 1.4 is reported.
excel_context_info — confirm hasExcelGlobal: true.excel_active_range — returns { address, values, rowCount, columnCount, formulas?, numberFormat? }.values and notes the truncation in the response. Narrow the selection or read a named sub-range instead.Use evaluate_script with the pattern from references/office-js-cheatsheet.md §3. Always guard with typeof Excel === 'undefined' and wrap in Excel.run.
list_pages — a new CDP target may have appeared (shared-runtime commands reuse the taskpane target; UI-less commands may not expose one).take_snapshot on the taskpane target to see post-command DOM.list_console_messages to surface any Office.js errors from the command handler.Office.context.ui.displayDialogAsync opens a new debuggable CDP target. After the add-in invokes it:
list_pages again — the dialog appears as a separate target.select_page to switch into the dialog.take_snapshot / click / evaluate_script as usual.Office.context.ui.messageParent (see cheatsheet §7); the parent handles them through Office.EventType.DialogMessageReceived.The dialog's startAddress must be HTTPS and same-origin with the taskpane. On Excel Online the dialog is an iframe modal — it is not a separate CDP target there, but this skill targets Excel desktop WebView2.
// Inside evaluate_script
if (Office.context.requirements.isSetSupported('ExcelApi', '1.12')) {
// Use Excel API 1.12 features
} else {
// Fall back or report unsupported
}Prefer probing over version-string comparison against diagnostics.version.
.** Excel throws PropertyNotLoaded`. Enumerate property names explicitly.Excel.run.typeof.excel-webview2 skill. Cross-link instead.`hasOfficeGlobal: false` — the attached target is not an add-in page. It may be the taskpane's sign-in iframe, a dialog, or the wrong tab. Run list_pages and select_page to switch.
`Excel.run` throws `PropertyNotLoaded` — a property was read without first being loaded. Add it to the range.load([...]) call and re-sync.
Dialog never appears in `list_pages` — the add-in may be running on Excel Online (where dialogs are iframes, not CDP targets), or the dialog's HTTPS/same-origin check failed. Check list_console_messages for the Office.js error.
Requirement set reports `false` unexpectedly — confirm Excel version via excel_context_info.hostInfo.version. ExcelApi versions are tied to specific Microsoft 365 builds.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.