Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/team-commonly/commonly/officecli-xlsxnpx skills add Team-Commonly/commonly --skill officecli-xlsxgit clone --depth 1 https://github.com/Team-Commonly/commonlyWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00119 | $0.09147 |
| Opus 5 | $0.00060 | $0.04574 |
| Sonnet 5 | $0.00024 | $0.01829 |
| Haiku 4.5 | $0.00012 | $0.00915 |
Grade C, and why
officecli-xlsx scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
- **macOS / Linux**: `curl -fsSL https://raw.githubusercontent.com/iOfficeAI/OfficeCLI/main/install.sh | bash` Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **macOS / Linux**: `curl -fsSL https://raw.githubusercontent.com/iOfficeAI/OfficeCLI/main/install.sh | bash` This is a copy
98% identical to officecli-xlsx — 5 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 488 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OfficeCLI XLSX Skill
Setup
If officecli is missing:
- macOS / Linux:
curl -fsSL https://raw.githubusercontent.com/iOfficeAI/OfficeCLI/main/install.sh | bash - Windows (PowerShell):
irm https://raw.githubusercontent.com/iOfficeAI/OfficeCLI/main/install.ps1 | iex
Verify with officecli --version (open a new terminal if PATH hasn't picked up). If install fails, download a binary from https://github.com/iOfficeAI/OfficeCLI/releases.
⚠️ Help-First Rule
This skill teaches what good xlsx looks like, not every command flag. When a property name, enum value, or alias is uncertain, consult help BEFORE guessing.
officecli help xlsx # List all xlsx elements
officecli help xlsx <element> # Full element schema (e.g. pivottable, chart, cf)
officecli help xlsx <verb> <element> # Verb-scoped (e.g. add chart, set cell)
officecli help xlsx <element> --json # Machine-readable schema
Help reflects the installed CLI version. When this skill and help disagree, help is authoritative.
Shell & Execution Discipline
Shell quoting (zsh / bash). Excel paths contain [], and number formats contain $. Both are shell metacharacters. Rules:
- ALWAYS quote element paths:
"/Sheet1/row[1]", not/Sheet1/row[1]. - Use single quotes for any prop value containing
$:numFmt='$#,##0'. - For formulas with cross-sheet
!references, usebatchwith a<<'EOF'heredoc (see Known Issues). - NEVER hand-write
\$,\t,\ninside executable examples. The CLI does not interpret backslash escapes; they will land in your file as literal characters.
Incremental execution. Run commands one at a time and read each exit code. officecli mutates the file on every call; a 50-command script that fails at command 3 will cascade silently. One command → check output → continue.
Requirements for Outputs
Before reaching for a command, know what a good xlsx looks like. These are the deliverable standards every workbook MUST meet.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 488 lines · 119 tokens per session scan C ac471970642b
officecli-xlsx is a skill published in the GitHub repository Team-Commonly/commonly (1,323 stars, last pushed 3d ago), licensed Apache-2.0. It adds 119 tokens to every session and 9,147 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). It is 98% identical to officecli-xlsx, differing in 5 lines, and is treated as a copy.
Other skills, from other repositories
gws-sheets-append
Google Sheets: Append a row to a spreadsheet.
gws-sheets-read
Google Sheets: Read values from a spreadsheet.
gws-sheets
Google Sheets: Read and write spreadsheets.
doc-reader
Read any common document/data file — PDF, Word (.docx), Excel (.xlsx/.xls), PowerPoint (.pptx), images (OCR), CSV/TSV, plain text, JSON/YAML/TOML, HTML/XML, and most source-code files. Use the readdocument tool.
review-agents-md
Audit Dograh AGENTS.md files for drift against the live repo and for bad scope boundaries between parent and child docs. Use when the user asks to review existing AGENTS files, identify stale guidance, decide whether a subtree needs its own AGENTS.md, or update the AGENTS.md hierarchy under the repo root, api/, or ui/.
review-pr
Review a Dograh pull request, branch diff, or pasted patch for repo-specific security and correctness risks that are not obvious from generic FastAPI, Next.js, or Python conventions. Use when the user asks to review a PR, audit a diff, check whether changes are safe to merge, review their own changes, or asks what to…