Expanso json-to-csv

Convert JSON arrays of objects into CSV format using Expanso Edge pipelines for CLI or MCP workflows.

Security Scan

This is an instruction-only skill that consistently implements a local JSON→CSV converter; it asks for no credentials and contains no hidden network calls or suspicious installs, with only minor documentation/instruction mismatches to note.

Purpose & Capability

The skill's name, README, pipelines and skill.yaml all describe a local JSON→CSV converter and the included pipeline definitions implement that. Minor mismatch: SKILL.md and README require the expanso-edge binary, but the registry metadata lists no required binaries — the runtime does in fact need expanso-edge to run the pipelines.

Instruction Scope

SKILL.md instructs the agent/user to run pipelines locally or start an MCP HTTP endpoint; the pipelines read input, build CSV, log a trace id, and return JSON results. No instructions read unrelated files or send data to external endpoints. Small inconsistency: the CLI pipeline reads env("DELIMITER") while skill.yaml defines a delimiter input — this means delimiter can come from an environment variable in CLI mode even though no env vars are declared.

Install Mechanism

No install spec or code is included by the skill bundle (instruction-only), so nothing is written to disk by an installer. The only runtime dependency is the expanso-edge binary (user-installed), which is a reasonable requirement for an Expanso pipeline.

Credentials

The skill declares no credentials and skill.yaml has empty credentials. The only environment access observed is the CLI pipeline reading DELIMITER from the environment; this is non-sensitive but was not listed in registry requires.env — not a security problem but an inconsistency to be aware of.

Persistence & Privilege

always: false and default invocation settings are used. The skill does not request permanent presence nor modify other skills or system configs. Running MCP mode will open an HTTP listener on 0.0.0.0:${PORT} if you start it locally — expected behavior for a server-mode pipeline.

Assessment

This skill appears to do exactly what it claims: convert JSON arrays to CSV locally. Before running it: 1) install expanso-edge from a trusted source (the pipelines require that binary), 2) if you run MCP mode be aware it will bind to 0.0.0.0:${PORT} and accept POSTs to /convert — consider running behind a firewall or on localhost only, and do not expose it to untrusted networks, 3) note the CLI pipeline reads a DELIMITER environment variable even though no env vars are declared in the registry (set DELIMITER if you want a different field separator), and 4) the deploy command in SKILL.md would publish the pipeline to Expanso Cloud — only do that if you intend to share the pipeline and trust the destination. No credentials or hidden network exfiltration were found.

json-to-csv

"Convert JSON array of objects to CSV format"

Requirements

• Expanso Edge installed (expanso-edge binary in PATH)
• Install via: clawhub install expanso-edge

Usage

CLI Pipeline

# Run standalone
echo '<input>' | expanso-edge run pipeline-cli.yaml

MCP Pipeline

# Start as MCP server
expanso-edge run pipeline-mcp.yaml

Deploy to Expanso Cloud

expanso-cli job deploy https://skills.expanso.io/json-to-csv/pipeline-cli.yaml

Files

File	Purpose
skill.yaml	Skill metadata (inputs, outputs, credentials)
pipeline-cli.yaml	Standalone CLI pipeline
pipeline-mcp.yaml	MCP server pipeline