ClawHub
Back to skill

Security audit

Json2csv

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward JSON-to-CSV converter, with a spreadsheet formula-injection caveat for untrusted input data.

Use this for trusted JSON data or inspect/sanitize CSV output before opening it in spreadsheet apps. Be cautious with JSON from other people or public sources because values beginning with formula characters such as =, +, -, or @ may be interpreted by spreadsheets.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
tool.py:54
Finding

CSV Formula Injection Through Unsanitized JSON Values

Content
View full analysis

Vulnerability Details

File Location: tool.py, lines 54–57
Vulnerability Type: CSV formula injection
Risk Level: Medium

python
with open(csv_file, 'w', newline='', encoding='utf-8') as f:
    writer = csv.DictWriter(f, fieldnames=fieldnames)
    writer.writeheader()
    writer.writerows(flat_data)

Technical Analysis

Values originating from the input JSON are written directly to CSV cells without neutralizing spreadsheet formula prefixes. Strings beginning with characters such as =, +, -, or @ may be interpreted as formulas when the generated file is opened in spreadsheet software. CSV quoting alone does not reliably prevent formula evaluation.

This issue is particularly relevant because the skill explicitly presents its output as suitable for spreadsheets. Exploitation requires an attacker to control or influence at least one value in the source JSON and a user to open the generated CSV in spreadsheet software that evaluates the crafted expression.

Attack Path

  1. An attacker supplies or modifies a JSON input value so that it begins with a spreadsheet formula prefix, for example:
    json
    {
  "name": "=HYPERLINK(\"https://attacker.example\",\"Open\")"
}
  2. The converter flattens the record without changing the malicious string.
  3. writer.writerows(flat_data) writes the value unchanged into the output CSV.
  4. A user opens the CSV in a spreadsheet application.
  5. If that application evaluates the cell as a formula, the attacker-controlled expression executes within the spreadsheet's formula environment.

Impact Assessment

The converter itself does not grant operating-system privileges, execute commands, or access the network. Impact occurs in the downstream spreadsheet application and depends on its features, security configuration, and user interaction.

Plausible effects include deceptive hyperlinks, external network requests that disclose con ...[truncated 270 chars]

Remediation
View remediation

Remediation Suggestions

Sanitize all string values before passing records to csv.DictWriter. If the first non-whitespace character is =, +, -, or @, prefix the value with an apostrophe or apply another spreadsheet-safe encoding policy. Also account for leading tab, carriage-return, and line-feed characters that could bypass a simple first-character check.

Enable this protection by default because the documented use case includes spreadsheets. If exact raw CSV preservation is required for trusted machine-to-machine workflows, provide an explicit opt-out and clearly document its security implications.

Add automated tests covering formula-prefixed values, leading whitespace and control characters, nested JSON values, and ordinary negative numeric values to avoid incorrect sanitization of genuine numbers.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.