ClawHub
Back to skill

Security audit

Csv Processor Free

Security checks across malware telemetry and agentic risk

Overview

This CSV skill appears purpose-aligned overall, but it asks for broad local read/write/exec authority while routing itself to generic analytics tasks beyond CSV processing.

Install only if you are comfortable with the agent reading and writing local CSV files and running Python/pip commands. Use it for explicit CSV tasks, review output paths before export/split operations, and avoid invoking it for general analytics or visualization requests that do not require CSV preprocessing.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

High
Confidence
96% confidence
Finding
The trigger condition is overly broad and can cause the agent to invoke this skill for many generic data-analysis or reporting requests, even when CSV processing is not necessary. In a skill that has read/write/exec capabilities, overbroad routing increases the chance of unnecessary file access, file modification, or command execution in response to ambiguous prompts.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill advertises export, save, modify, and exec-backed operations without prominently warning that it may write files or execute local commands. This is dangerous because users or upstream agents may invoke the skill assuming passive analysis, while the documented capabilities enable state-changing filesystem actions and command execution that could be abused if inputs are attacker-controlled or ambiguous.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.