ClawHub
Back to skill

Security audit

Csv Analyzer Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a lightweight CSV analysis guide with expected local file reading, command execution, and optional CSV export behavior, with no evidence of hidden or malicious actions.

Install only if you want an agent to inspect local CSV files and possibly create exported CSV results. Review input and output paths before use, especially with sensitive data or existing files that could be overwritten.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The skill description claims applicability to essentially any 'csv analyzer related' development scenario, which creates an overly broad activation scope. In agent ecosystems, broad trigger language can cause the skill to activate in contexts the user did not intend, increasing the chance of unnecessary file access, command execution, or output generation through the declared read/exec/write tools.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The documentation describes exporting filtered results with --output but does not warn that this operation writes to disk and may overwrite existing files depending on implementation. In a skill with write and exec capabilities, missing overwrite and path-safety warnings can lead to accidental data loss or unintended file creation if the agent chooses unsafe output paths.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.