ClawHub
Back to skill

Security audit

CSV Inspect

Security checks across malware telemetry and agentic risk

Overview

This skill is a bounded CSV preview tool that discloses its row-sampling behavior and does not show hidden persistence, credential use, networking, or destructive actions.

Install this only if you want agents to preview local CSV/TSV contents before analysis. Treat its output as potentially sensitive because it can include real cell values from the first rows and type samples; avoid using it on regulated or secret data unless the transcript/output location is acceptable.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script intentionally prints column names plus head/tail rows and sample values, which can expose sensitive data present in CSV files directly to the terminal or calling agent. In an agent skill context, that output may be logged, forwarded, or shown to users without any redaction or warning, increasing the risk of accidental disclosure of secrets, PII, or regulated data.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.