CSV

Parse and generate RFC 4180 compliant CSV that works across tools.

Security Scan

The skill is an instruction-only CSV guidance doc whose requirements and instructions align with its stated purpose and request no elevated access.

Purpose & Capability

Name/description (RFC 4180 CSV parsing/generation) matches the content of SKILL.md. The skill requests no binaries, env vars, or install steps — all proportional to a documentation-style helper.

Instruction Scope

SKILL.md contains parsing/generation rules (quoting, delimiters, encoding, Excel quirks, validation notes). It does not instruct the agent to read arbitrary system files, access environment variables, or transmit data externally; scope is limited to CSV handling guidance.

Install Mechanism

No install spec and no code files are present. This instruction-only form is low-risk since nothing is written to disk or fetched at install time.

Credentials

The skill declares no environment variables, credentials, or config paths — consistent with a documentation-only helper and proportional to its stated purpose.

Persistence & Privilege

always is false and the skill is user-invocable; it does not request persistent system presence or modify other skills/configuration.

Assessment

This is a documentation-only CSV helper and appears safe to install — it asks for no credentials and performs no installs. Consider: (1) confirm you trust the skill author/source even though no code is installed; (2) if the agent will use this guidance to process sensitive CSVs, ensure file-access permissions and data handling policies are appropriate; (3) if you need executable behavior (parsing libraries), prefer a vetted implementation rather than ad-hoc agent steps.

Quoting Rules

• Fields containing comma, quote, or newline MUST be wrapped in double quotes
• Double quotes inside quoted fields escape as "" (two quotes), not backslash
• Unquoted fields with leading/trailing spaces—some parsers trim, some don't; quote to preserve
• Empty field ,, vs empty string ,"",—semantically different; be explicit

Delimiters

• CSV isn't always comma—detect ; (European Excel), \t (TSV), | in legacy systems
• Excel exports use system locale delimiter; semicolon common in non-US regions
• Sniff delimiter from first line but verify—header might not contain special chars

Encoding

• UTF-8 BOM (0xEF 0xBB 0xBF) breaks naive parsers but Excel needs it for UTF-8 detection
• When generating for Excel on Windows: add BOM; for programmatic use: omit BOM
• Latin-1 vs UTF-8 ambiguity—explicitly declare or detect encoding before parsing

Common Parsing Failures

• Newlines inside quoted fields are valid—don't split on \n before parsing
• Unescaped quote in middle of field corrupts rest of file—validate early
• Trailing newline at EOF—some parsers create empty last row; strip or handle
• Inconsistent column count per row—validate all rows match header count

Numbers & Dates

• 1,234.56 vs 1.234,56—locale-dependent; standardize or document format
• Dates: ISO 8601 (2024-01-15) only unambiguous format; 01/02/24 is chaos
• Leading zeros in numeric fields (007)—quote to preserve or document as string

Excel Quirks

• Formula injection: fields starting with =, +, -, @ execute as formulas—prefix with ' or tab
• Long numbers (>15 digits) lose precision—quote and format as text
• Scientific notation triggered by E in numbers—quote if literal text needed