Clean CSV Toolkit

AdvisoryAudited by Static analysis on May 12, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Running cleanup or conversion commands can overwrite the selected output path and can create reports containing rows from the source data.

Why it was flagged

The toolkit writes cleaned outputs and optional removed-row reports to caller-provided paths. This is expected for a cleanup tool, but it can create or overwrite local files chosen by the user or agent.

Skill content
with output_path.open("w", encoding="utf-8", newline="") as fh: ... if removed_report is not None: ... removed_report.open("w", encoding="utf-8")
Recommendation

Use explicit new output paths, avoid pointing outputs at originals or protected locations unless intended, and review generated files before forwarding them.

What this means

Names, emails, customer records, or other sensitive cell values could be exposed in tool output if the selected file contains them.

Why it was flagged

The inspection report includes sample cell values from the input file. This is purpose-aligned, but those values may become visible in the agent conversation or logs.

Skill content
"sample": sample_values ... sample_str = ", ".join(repr(s) ... for s in c["sample"])
Recommendation

Inspect only files appropriate for the agent context, and use options such as `--sample 0` when you need structure without exposing example values.