ClawHub
Back to skill

Security audit

Csv Handler Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a local CSV processing guide with some boilerplate-style callback and API key language that users should treat cautiously, but it does not show hidden or destructive behavior.

Install only if you want a lightweight CSV-handling prompt skill. Do not provide an API key or callback URL unless you know why it is needed, and choose output paths carefully because exported CSV files may overwrite existing files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
Requesting a callback URL for a supposedly local CSV utility introduces an unnecessary network egress path that could send processed data or metadata to an attacker-controlled endpoint. Combined with generic API-key setup language, this can normalize external transmission for a task that should be file-local, increasing risk of data leakage and user confusion.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
Requiring an LLM API key and environment-variable configuration for a basic CSV read/clean/export skill is inconsistent with the described functionality and may prompt users to provision secrets unnecessarily. That creates avoidable secret-handling exposure and suggests the skill may invoke external services despite appearing to be a local utility.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The export functionality describes writing output files without warning about overwrite behavior, destination safety, or file modification risks. In agent contexts with write/exec tools, that omission can lead to unintentional destruction of existing files or writing sensitive processed data to unsafe locations.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
A callback URL feature without any privacy or security warning can cause users to unknowingly authorize transmission of CSV-derived results to arbitrary remote endpoints. For CSV data that may contain financial, operational, or personal information, silent network exfiltration materially increases confidentiality risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.