ClawHub
Back to skill

Security audit

CSV数据分析器

Security checks across malware telemetry and agentic risk

Overview

This CSV-analysis skill is purpose-aligned and low risk, though its documentation is incomplete and users should be careful with output files.

Install only if you are comfortable letting the agent read CSV files you choose and run local Python commands for analysis. Use explicit output paths in a safe workspace, avoid writing over important files, and verify the actual analyzer script exists before relying on the documented commands.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill advertises exporting filtered results to CSV but does not warn users about file creation or possible overwrite/modify effects. In an agent environment with write capability, ambiguous output-path behavior can lead to unintended data loss, clobbering existing files, or writing sensitive derived data to unsafe locations.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The manifest exposes exec capability without clearly warning users that the skill may run local commands and produce filesystem side effects. In a tool-enabled agent, understated command execution increases the chance of users invoking the skill without understanding execution risk, especially when combined with broad activation language.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.