# Workbook Editor

> Use when inspecting, reading, rendering, editing, formatting, diffing, or validating local .xlsx and .xlsm Excel workbooks. Provides fail-closed workbook tools with dry-run planning, SHA-256 conflict protection, PNG previews, and byte-identity checks for VBA and other protected OOXML parts. Do not use for CSV-only work or for executing/editing VBA.

- **Type:** Skill
- **Install:** `agentstack add skill-firstp1ck-pi-coding-agent-forge-workbook-editor`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Firstp1ck](https://agentstack.voostack.com/s/firstp1ck)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Firstp1ck](https://github.com/Firstp1ck)
- **Source:** https://github.com/Firstp1ck/pi-coding-agent-forge/tree/main/pi-extension-workbook/skills/workbook-editor

## Install

```sh
agentstack add skill-firstp1ck-pi-coding-agent-forge-workbook-editor
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Workbook Editor

Use the six `workbook_*` tools for semantic and visual workbook work. Treat every workbook as potentially hostile active content.

## Required workflow

1. Call `workbook_inspect` before editing an unfamiliar workbook. Review validation warnings, external relationships, protected parts, and engine capabilities.
2. Call `workbook_read` for the exact sheet/range. Call `workbook_render` whenever layout, fills, borders, dimensions, or visual comparison matter.
3. Build an ordered operation list and call `workbook_edit` with `dryRun: true`. Save the returned `sourceSha256`.
4. Commit to a new output path by default. Set `dryRun: false` and pass the exact `expectedSha256` from the current inspection/dry run.
5. Call `workbook_validate` on the result, using the source as `baselinePath` for `.xlsm` or active-content work.
6. Call `workbook_diff` and render the affected range. Report the output and any recovery path.

## Operation intent

- Use `setValue` for literal text, numbers, booleans, or null. Leading `=`, `+`, `-`, and `@` remain text when passed as strings.
- Use `setFormula` only for formulas. External-workbook, URL, DDE, `WEBSERVICE`, `FILTERXML`, and RTD constructs are rejected.
- Use `setStyle` for explicit font, fill, border, alignment, number-format, or cell-protection patches.
- Use `copyRange` for same-sized range templates; set optional `sourceSheet` for cross-sheet copies. Use `copyFormat` when only styles should be reproduced and `fillRange` to translate ordinary relative A1 formulas from one source cell.
- Shared, array, data-table, and spill formula regions are preservation-only. Value/content edits that intersect them fail closed; inspect formula inventory before restructuring formula-heavy sheets.
- Use `clear`, dimensions, merge, and unmerge operations only after reading existing merges and layout.

## Safety rules

- Never execute macros. Preservation does not imply that VBA was reviewed, trusted, or safe.
- Never request VBA source mutation or workbook macro execution through these tools; those capabilities are intentionally absent.
- Never refresh external links, Power Query, DDE, or data connections.
- Never silently convert `.xlsm` and `.xlsx`; output extension must match source.
- Never omit `expectedSha256` on a commit or retry a conflict using an old hash.
- Never overwrite in place unless the user explicitly asked. In-place writes require `overwrite: true` and return a recovery copy.
- Do not suggest lossy fallback libraries when the engine rejects an unsupported operation.
- Keep ranges focused. Full structured results are stored in temporary artifacts when model-visible output is truncated.

## Backend policy

The enabled backend is `ooxml-safe`, a bounded surgical implementation. It changes only operation-declared OOXML parts and verifies protected parts after saving; per-file package mutability checks can reject an otherwise supported operation. Native Excel may appear in `/workbook-doctor`, but mutation is disabled because the bounded bakeoff changed merged-cell styles during `.xlsx` no-op serialization and changed `xl/vbaProject.bin` during `.xlsm` no-op serialization. Aspose is an optional deferred tier.

## Verification expectations

A successful edit is not complete until:

- `workbook_validate` reports `ok: true`;
- `workbook_diff` shows only operation-declared OOXML changes;
- protected-part changes are empty;
- the focused PNG preview is visually reasonable when formatting changed;
- any warnings, truncation, unsupported rich objects, or missing native Excel repair-prompt check are disclosed.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Firstp1ck](https://github.com/Firstp1ck)
- **Source:** [Firstp1ck/pi-coding-agent-forge](https://github.com/Firstp1ck/pi-coding-agent-forge)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-firstp1ck-pi-coding-agent-forge-workbook-editor
- Seller: https://agentstack.voostack.com/s/firstp1ck
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.