XLSX formula inventory
Audit the formulas in an Excel (.xlsx) workbook without evaluating them.
Working…
Questions people ask
- Is any formula executed during the audit?
- Never. The workbook is opened in expression mode and the inventory is the list of stored formula TEXT. The tool opens no external connection and runs no spreadsheet engine.
- How are external references detected?
- A formula carrying a bracketed workbook citation, such as [Budget.xlsx]Sheet1!A1 or the index form [1]Sheet1!A1, is counted as a likely external reference and the citation label is captured. This is explicitly a heuristic over formula TEXT: a value pasted from another workbook, a defined name that hides a link, or an external data connection is not visible to a formula-text scan, and the report says so plainly.
- What happens with macro workbooks?
- They are refused outright (the report carries no formulas). A macro-enabled .xlsm is a different threat model to open; save the sheet as a plain .xlsx without macros and retry.
- What are DDE-shaped and error-token counts?
- DDE-shaped marks expressions that carry the classic =cmd|'/c …'! channel syntax used by CSV-injection payloads and legacy dynamic data exchange. Error tokens count formulas that reference broken results (#REF!, #NAME?, #VALUE!, #DIV/0!, #N/A) inside their text.
- How much of the workbook is listed?
- Counts are always complete for the worksheets that scan; the detailed listing samples up to 25 formulas per worksheet and 400 in total, and the report flags the truncation. Up to two million cells are walked before the scan declares itself bounded.