Security audit

csv-cleanroom

Security checks for vulnerabilities and agentic risk

Overview

This CSV helper skill is local, purpose-aligned, and disclosed, with only minor scoping and documentation caveats.

Install only if you are comfortable giving the agent access to CSV files you explicitly provide. Treat the bundled script as a basic profiler, review the generated JSON before acting on it, and avoid pointing it at sensitive datasets unless that is intended.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The code does perform a basic form of CSV profiling by reading a CSV via DictReader, listing columns, counting rows, and computing per-column null counts. However, it does not implement column standardization, broader data quality checks, or any reproducible cleanup plan generation as claimed. There are no suspicious undeclared capabilities or resource accesses beyond local file input/output, but the declared description materially overstates the functionality compared with the actual behavior.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The listed trigger examples include generic phrases such as "清洗 CSV", "数据质量检查", "列名规范化", and "build a cleanup plan" without clear scope limits or exclusion conditions. These phrases are broad enough that ordinary user requests could unintentionally match the skill, and the README does not provide negative examples or tighter activation constraints.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill declares a local helper script and the analysis detected file read/write capabilities, but the manifest does not define any explicit tool scope such as permissions or allowed-tools. That creates an avoidable trust gap: an agent may invoke filesystem-capable behavior without a clear least-privilege declaration, increasing the chance of unintended file access or modification when processing user-supplied CSV paths.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The example trigger phrases are broad and generic, such as 'profile this dataset' and '清洗 CSV', which can activate the skill in situations where the user may not have intended this specific workflow. Overly broad activation language can cause incorrect routing, unintended handling of sensitive data, or inappropriate application of cleanup logic to unrelated tasks.

Natural-Language Policy Violations

Low

Confidence: 80% confidence
Finding: The document presents core usage information in a mixed Chinese-and-English format, but it does not state whether the skill supports user language preference or how language is selected. This can violate language or locale expectations if the skill effectively imposes a default language presentation without user opt-in.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: The document presents instructions and examples in both Chinese and English, but it does not state whether the skill should respond in the user's preferred language or offer a language choice. This can create a language-policy issue if the skill implicitly forces mixed-language behavior without user opt-in.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: This markdown file contains user-facing instructions entirely in Chinese, which effectively forces a specific language for readers of the skill documentation. Under the policy, language constraints should either be optional for the user or clearly documented as a justified locale-specific requirement.

Static analysis

No suspicious patterns detected.