csv-cleanroom

Security checks across malware telemetry and agentic risk

Overview

This is a local CSV profiling helper with expected file input and local report output, and no evidence of hidden network, credential, persistence, or destructive behavior.

Reasonable to install for local CSV profiling. Use it only on datasets you intend to inspect locally, set --out to a safe new report path when preserving files matters, and review any proposed cleanup steps before applying changes to original data.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises use of a local Python script to process CSVs and potentially produce transformed output, which implies file read/write capability, but it does not declare any permissions or equivalent safety boundary in the manifest. This creates a transparency and governance gap: an agent or reviewer may underestimate the skill's access to local data, increasing the chance of unintended file access or modification when handling user-provided datasets.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal