CSV Wizard

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

A user could unintentionally produce a cleaned file that omits or changes data if they choose the wrong options.

Why it was flagged

The documented command can change CSV contents by removing rows and filling values, then write an output file. This is expected for a CSV-cleaning tool, but users should verify the output before relying on it.

Skill content

/clean-csv sales.csv --drop-duplicates --fill-missing median --output clean-sales.csv

Recommendation

Run it on copies or specify a separate output file, and review the cleaned CSV before replacing important data.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If the external repository changes or is not trustworthy, running its CLI could expose local files or alter data outside what was reviewed here.

Why it was flagged

The README points users to external code that is not included in the submitted artifact set. This is user-directed rather than automatic, but it means users should review the external repository before running it.

Skill content

git clone https://github.com/kimi-claw/skill-csv-wizard.git
cd skill-csv-wizard
./bin/clean-csv --help

Recommendation

Inspect the external repository before use, prefer a trusted pinned commit or release, and avoid running unreviewed code on sensitive CSV files.