bilig-workpaper — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bilig-workpaper (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Bilig WorkPaper gives agents a code-first workbook runtime for spreadsheet-style business logic. Use it when the task is easier to model as sheets and formulas, but the reliable path is to edit cells through an API, recalculate, read computed values back, and persist a JSON workbook document.
The main use case is replacing fragile spreadsheet UI automation with deterministic tool calls. It is useful for quote calculators, payout models, budget checks, import validation, and reduced XLSX formula bug reports.
Use this skill when the user needs to:
Do not use it for manual spreadsheet editing, VBA/macros, pivots, charts, COM automation, or exact desktop Excel behavior unless the user explicitly asks to compare against Excel as an oracle.
Prefer argument arrays in MCP/client configuration. Do not shell-concatenate user-provided paths, sheet names, formulas, or cell addresses. Reject path or cell input containing newlines, backticks, $(, ;, &, |, <, or > before using it in a command.
The MCP examples execute the public @bilig/workpaper npm package. Treat that as third-party code execution: pin the package version you reviewed, run it only in a trusted project, and get explicit user approval before starting a writable MCP server.
First prove the package-owned challenge works:
{
"command": "npm",
"args": ["exec", "--package", "@bilig/workpaper@<reviewed-version>", "--", "bilig-mcp-challenge"]
}Then run a writable file-backed MCP server:
{
"command": "npm",
"args": [
"exec",
"--package",
"@bilig/workpaper@<reviewed-version>",
"--",
"bilig-workpaper-mcp",
"--workpaper",
"./pricing.workpaper.json",
"--init-demo-workpaper",
"--writable"
]
}Useful tools exposed by the MCP server:
list_sheetsread_rangeread_cellset_cell_contentsget_cell_display_valueexport_workpaper_documentvalidate_formulaAfter every write, read the dependent output cell and export the WorkPaper document. Do not claim success from the write call alone.
Use the package directly when workbook logic belongs inside application code:
import {
WorkPaper,
exportWorkPaperDocument,
serializeWorkPaperDocument,
} from "@bilig/workpaper";
const workbook = WorkPaper.buildFromSheets({
Inputs: [
["Metric", "Value"],
["Customers", 20],
["Average revenue", 1200],
],
Summary: [
["Metric", "Value"],
["Revenue", "=Inputs!B2*Inputs!B3"],
],
});
const inputs = workbook.getSheetId("Inputs");
const summary = workbook.getSheetId("Summary");
if (inputs === undefined || summary === undefined) {
throw new Error("Workbook is missing required sheets");
}
workbook.setCellContents({ sheet: inputs, row: 1, col: 1 }, 32);
const revenue = workbook.getCellDisplayValue({ sheet: summary, row: 1, col: 1 });
const saved = serializeWorkPaperDocument(
exportWorkPaperDocument(workbook, { includeConfig: true }),
);
console.log({ revenue, savedBytes: saved.length });A good agent response should include:
If any proof step fails, report the blocker instead of saying the workbook was updated.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.