ClawHub
Back to skill

Security audit

CSV Data Processor

Security checks across malware telemetry and agentic risk

Overview

This is a coherent CSV utility, but one helper evaluates filter text as Python code, so users should review it before installing.

Install only if you trust whoever supplies filter expressions and understand that --where is interpreted as Python expression syntax. Avoid using untrusted filter strings, especially from downloaded files, prompts, or automation, and prefer a version that replaces eval with a restricted comparison parser.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

eval() call detected

High
Category
Dangerous Code Execution
Content
except ValueError:
                        pass
            try:
                if eval(args.where, {"__builtins__": {}}, env):
                    filtered.append(row)
            except Exception as e:
                print(f"Filter error: {e}")
Confidence
92% confidence
Finding
if eval(args.where, {"__builtins__": {}}, env):

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/csv_filter.py:43