ClawHub
Back to skill

Security audit

CSV Tools

Security checks across malware telemetry and agentic risk

Overview

This is a local CSV-processing skill with no network behavior; the main caution is that some commands create or overwrite output CSV files by default.

Reasonable to install for local CSV work. Review commands before running them on important directories because filter, sort, merge, split, and dedup default to output filenames such as filtered.csv, sorted.csv, merged.csv, chunk.csv, and deduped.csv, and the script does not enforce overwrite confirmation despite claiming that boundary.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Low
Confidence
93% confidence
Finding
This file contains a natural-language comment that forces a specific language context for readers without any indication of user choice or locale-specific justification. The policy applies to all file types and treats unprompted language restriction as a natural-language policy issue.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.