ClawHub
Back to skill

Security audit

Csv Json Converter Free

Security checks across malware telemetry and agentic risk

Overview

The skill mostly performs local CSV-to-JSON conversion, but its privacy and network-related statements are unclear enough that users should review it before installing.

Install only if you are comfortable using it through an AI agent that may see prompts or file excerpts. Avoid sensitive CSVs unless your agent environment has appropriate privacy controls, ignore callback_url unless you explicitly need and trust it, and confirm output paths before writing JSON files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
76% confidence
Finding
Introducing a callback URL and network-oriented workflow into a tool advertised for local CSV/JSON conversion expands the operational surface unnecessarily. In an agent environment with read/exec/write tools, ambiguous network-facing parameters can be repurposed to send data to attacker-controlled endpoints or to justify outbound requests unrelated to the user’s local conversion task.

Intent-Code Divergence

High
Confidence
89% confidence
Finding
The document claims processing is fully local and that data is not uploaded externally, while also stating dependence on an LLM API and including callback/network concepts elsewhere. This mismatch can cause users to disclose sensitive files under a false expectation of locality, leading to unintended external transmission of file content, metadata, or prompts through the agent platform or related integrations.

Missing User Warnings

Medium
Confidence
78% confidence
Finding
The skill provides write-out behavior for JSON files but does not clearly warn about overwriting or modifying local files. In agent environments with write/exec permissions, missing confirmation and path-safety guidance can lead to unintended data loss, clobbering of existing files, or writes to attacker-influenced paths.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.