Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add shawnclybor/clybor-claude-tooling --skill excel-connector-governancegit clone --depth 1 https://github.com/shawnclybor/clybor-claude-toolingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/shawnclybor/clybor-claude-tooling/excel-connector-governance)<a href="https://agentmods.dev/skills/shawnclybor/clybor-claude-tooling/excel-connector-governance"><img src="https://agentmods.dev/badge/skills/shawnclybor/clybor-claude-tooling/excel-connector-governance/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/shawnclybor/clybor-claude-tooling/excel-connector-governance"><img src="https://agentmods.dev/badge/skills/shawnclybor/clybor-claude-tooling/excel-connector-governance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00182 | $0.03869 |
| Opus 5.5 | $0.00073 | $0.01548 |
| Sonnet 5.5 | $0.00036 | $0.00774 |
| Haiku 4.5 | $0.00018 | $0.00387 |
Grade A, and why
excel-connector-governance scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
const res = await fetch(url, { How it starts
The opening of the file, as written. The whole thing — 250 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Excel Connector Governance (Copilot Studio → Excel Online → SharePoint)
Governance for driving Excel Online (Business) through a Microsoft Copilot Studio
agent against .xlsx files hosted in SharePoint. Loaded on demand — never auto-loaded.
Every claim below was verified live against a real tenant on 2026-08-14 unless marked
UNVERIFIED (doc-sourced). Several of these findings contradict, or simply do not appear in,
Microsoft's documentation. Do not re-derive them from the docs.
Tenant-neutral by design. Bot IDs, environment GUIDs, site names, drive-item IDs and workbook names are deliberately absent — record those in the project's own governance, not here. What lives here is connector behaviour that holds across tenants.
The Golden Rule
A pinned File input is an opaque ID, not a filename. Until you have resolved that ID back to a filename yourself, you do not know which workbook the tool writes to — and a wrongly-pinned tool is more dangerous than an unpinned one, because it fails identically every time and, against a healthy workbook, would not fail at all.
Verification context
Findings were established with Standard orchestration (reached via "Other ways to build", not the GitHub Copilot harness), a draft unpublished agent, and end-user credentials on the connection. A purpose-built smoke-test workbook with one formatted table and a unique key column was used as the control — build one before trusting any finding against a client file. A control workbook is what separates "the connector is broken" from "this workbook is broken."
Operation coverage — what actually works
| Operation | Connector action | Status |
|---|---|---|
| Read | List rows present in a table (GetItems) |
Works. ~5s observed. |
| Create | Add a row into a table (AddRowV2) |
Works. ~80s observed. |
| Update | Update a row (PatchItem) |
Works. Verified at XML level. ≤20s observed. |
| Delete | — | No connector action exists. Requires an Office Script via Run script. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 250 lines · 182 tokens per session scan A f6ae145f7153
excel-connector-governance is a skill published in the GitHub repository shawnclybor/clybor-claude-tooling (6 stars, last pushed 7d ago), licensed MIT. It adds 182 tokens to every session and 3,869 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
xlsx
Use this skill any time a spreadsheet file is the primary input or output. This means any task where the user wants to: open, read, edit, or fix an existing .xlsx, .xlsm, .csv, or .tsv file (e.g., adding columns, computing formulas, formatting, charting, cleaning messy data); create a new spreadsheet from scratch or…
dcf-model
Build discounted cash flow valuation workbooks in Excel.
comps-analysis
Build comparable-company valuation workbooks in Excel.
lbo-model
Build leveraged buyout workbooks with IRR/MOIC in Excel.
xlsx
Create, read, edit Excel .xlsx workbooks and CSVs.
excel-author
Build auditable financial workbooks headless via openpyxl.