Expanso csv-to-json

Convert CSV input into a JSON array of objects using Expanso Edge CLI or MCP pipelines.

Security Scan

This instruction-only skill is internally consistent with its stated purpose (converting CSV to JSON), runs locally, and does not request credentials or install external code.

Purpose & Capability

The skill name, README, SKILL.md, and pipeline files all describe a local CSV→JSON conversion. The only runtime dependency is expanso-edge (expected for Expanso pipelines). No unrelated credentials, binaries, or config paths are requested.

Instruction Scope

Runtime instructions are narrowly scoped to running the provided Expanso pipelines (CLI/stdin or MCP HTTP endpoint). The pipelines only read CSV input (stdin or HTTP body), an optional DELIMITER env var and optional PORT, and produce JSON output. Note: the MCP pipeline binds to 0.0.0.0:${PORT:-8080} and exposes an unauthenticated /convert POST endpoint — this is expected for a simple local server but is a security consideration if you run it on a publicly reachable host.

Install Mechanism

There is no install spec and no files that will be fetched or executed by the skill at install time. It is instruction-only, so nothing is written to disk by the skill itself during installation.

Credentials

The skill does not declare or require any credentials or sensitive environment variables. The pipelines reference optional environment vars (DELIMITER, PORT) that are appropriate and proportional to the task.

Persistence & Privilege

The skill does not request permanent presence (always is false) and does not modify other skills or system settings. It runs when invoked and has no elevated platform privileges.

Assessment

This skill appears to do only local CSV→JSON conversions and is coherent with its metadata. Before installing or running it: 1) ensure you trust the expanso-edge binary you will run (the skill relies on it to execute pipelines); 2) avoid piping sensitive secrets into the pipeline (it will include any input in output/metadata); 3) if you run MCP mode, be aware it listens on 0.0.0.0 by default and exposes an unauthenticated /convert POST endpoint — bind to localhost or use firewall/authentication if you don't want it reachable from untrusted networks; 4) the SKILL.md mentions an optional deploy command to Expanso Cloud — deploying would send the pipeline to that service, so don't deploy sensitive data unless you trust the remote service and have reviewed its privacy policy.

csv-to-json

"Convert CSV data to JSON array of objects"

Requirements

• Expanso Edge installed (expanso-edge binary in PATH)
• Install via: clawhub install expanso-edge

Usage

CLI Pipeline

# Run standalone
echo '<input>' | expanso-edge run pipeline-cli.yaml

MCP Pipeline

# Start as MCP server
expanso-edge run pipeline-mcp.yaml

Deploy to Expanso Cloud

expanso-cli job deploy https://skills.expanso.io/csv-to-json/pipeline-cli.yaml

Files

File	Purpose
skill.yaml	Skill metadata (inputs, outputs, credentials)
pipeline-cli.yaml	Standalone CLI pipeline
pipeline-mcp.yaml	MCP server pipeline