Expanso csv-to-json

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:56 PM UTC
• Version: 1.0.0

Overview

This looks like a simple CSV-to-JSON converter, but its server mode is broader than users may expect because it binds to all network interfaces without authentication or a visible request-size limit.

Use the CLI mode when possible. If running the server mode, bind it to 127.0.0.1 or put it behind firewall/authentication controls, and add request-size and rate limits before exposing it on any shared or public network. Treat the optional cloud deploy command as using a live external URL rather than only the reviewed local file.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: pipeline-mcp.yaml:10

Finding

Unauthenticated HTTP Service Exposed on All Network Interfaces

Content

View full analysis

Vulnerability Details

File Location: pipeline-mcp.yaml, lines 10–17
Vulnerability Type: Unauthenticated network service exposure
Risk Level: Medium

Vulnerable Code

yaml

config:
  http:
    enabled: true
    address: "0.0.0.0:${PORT:-8080}"

  input:
    http_server:
      path: /convert
      allowed_verbs: [POST]
      timeout: 60s

Technical Analysis

The MCP pipeline binds its HTTP server to 0.0.0.0, exposing the /convert endpoint through every network interface available to the host. The configuration does not define authentication or authorization controls.

The endpoint processes attacker-controlled CSV content in memory. Unlike the CLI pipeline, which sets max_buffer: 10485760, no equivalent HTTP request-body limit is visible in the MCP pipeline. The 60-second timeout limits request duration but does not prevent unauthorized requests, oversized payloads, concurrent submissions, or repeated resource consumption.

The documented example sends requests to localhost, which may lead operators to expect local-only access even though the actual binding is network-wide.

Attack Path

1. An operator starts pipeline-mcp.yaml with the default configuration.
2. The service listens on all host interfaces on port 8080 by default.
3. A network-reachable attacker discovers or directly accesses the exposed port.
4. The attacker sends unauthenticated POST requests to /convert containing attacker-controlled CSV data.
5. The pipeline splits the supplied content into lines and fields and constructs an in-memory JSON response.
6. The attacker repeats requests or submits large inputs to consume CPU and memory, potentially degrading or denying service to legitimate users.

Impact Assessment

A remote, network-reachable attacker can invoke the conversion endpoint without authorization. No operating-system privilege escalation, command execution, credential access, or pe ...[truncated 276 chars]

Remediation

View remediation

Remediation Suggestions

1. Bind to loopback by default:

   yaml

   address: "127.0.0.1:${PORT:-8080}"
   

2. If remote access is required, place the service behind an authenticated reverse proxy or add explicit application-level authentication and authorization.
3. Enforce a strict HTTP request-body size limit comparable to the CLI pipeline's 10 MiB cap, or lower based on operational requirements.
4. Add per-client rate limiting, concurrency limits, and resource quotas.
5. Use TLS for traffic crossing an untrusted network and restrict source addresses through firewall rules or network allowlists.
6. Document that binding to 0.0.0.0 creates remote exposure and should require an explicit opt-in.
7. Add security tests covering unauthenticated access, oversized request rejection, concurrent request limits, and non-loopback binding behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

bash

PORT=8080 expanso-edge run pipeline-mcp.yaml &
curl -X POST http://localhost:8080/convert \
  -H "Content-Type: application/json" \
  -d '{"csv": "name,age\nAlice,30\nBob,25"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · pipeline-mcp.yaml (reported line 6)May include surrounding context.

yaml

#
# Usage:
#   PORT=8080 expanso-edge run pipeline-mcp.yaml &
#   curl -X POST http://localhost:8080/convert -d '{"csv": "name,age\nAlice,30"}'

name: "csv-to-json-mcp"
type: pipeline

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This is a manifest file, so trigger clarity applies. The skill declares generic inputs like "stdin" and "http_server" but provides no specificity about when requests should invoke this skill, what routes or contexts are valid, or any exclusion conditions, which can make invocation scope ambiguous.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.