Csv Toolkit Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:26 AM UTC
• Version: 1.0.0

Overview

This CSV reference skill is not malicious, but it asks for broader write and command-execution authority than its documentation-only purpose clearly justifies.

Review this skill before installing. It appears to be a CSV guidance document, not a malicious package, but it should be limited to read-only CSV help unless you specifically trust it to write files or run commands. Be cautious about the Excel formula-injection examples because the included sanitizer is incomplete for hostile input.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:182

Finding

Excel Formula Injection Sanitizer Can Be Bypassed with Leading Whitespace or Control Characters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 182-184
Vulnerability Type: Incomplete input sanitization for spreadsheet formula injection
Risk Level: Medium

Vulnerable Code:

python

if isinstance(value, str) and value and value[0] in '=+-@':
    return f"'{value}"
return value

Technical Analysis

The sanitizer examines only the first character of a string. An attacker can place whitespace or control characters, such as a tab, carriage return, or line feed, before a dangerous formula marker. If spreadsheet software strips, ignores, or normalizes that prefix during import, the resulting cell may still be interpreted as a formula.

The document also recommends using a tab as a protective prefix at lines 102 and 232. A tab is not a dependable security boundary because spreadsheet applications and import workflows differ in how they process leading control characters.

This issue applies when attacker-controlled values are exported to CSV and subsequently opened in spreadsheet software. Its exploitability and resulting behavior depend on the spreadsheet application, version, security configuration, and formula features available.

Attack Path

1. An attacker submits a CSV field containing leading whitespace or a control character followed by a formula marker, such as a tab followed by =.
2. sanitize_for_excel checks only value[0], which is the leading character rather than the formula marker.
3. The function returns the value without neutralizing it.
4. The application writes the value to an exported CSV file.
5. A user opens or imports the file in spreadsheet software.
6. If the spreadsheet normalizes the leading character and recognizes the remaining value as a formula, it evaluates the attacker-controlled expression.

Impact Assessment

Successful exploitation can execute attacker-controlled spreadsheet formulas in the security context of the user opening the file. De ...[truncated 391 chars]

Remediation

View remediation

Remediation Suggestions

• Treat all externally supplied cells as untrusted before CSV generation.
• Detect formula markers after accounting for all leading whitespace and control characters, rather than checking only value[0].
• Reject unexpected control characters or apply a strict allowlist for fields that do not require them.
• Do not present a tab prefix as a universally reliable formula-injection defense.
• Use a spreadsheet-specific export library or format that can explicitly create text cells when spreadsheet output is the intended destination.
• If CSV must be used, define and test an escaping policy against every supported spreadsheet application and import workflow.
• Add regression tests for spaces, tabs, carriage returns, line feeds, Unicode whitespace, and each dangerous marker: =, +, -, and @.
• Consider rejecting formula-like values entirely in high-security exports instead of attempting to preserve them.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:15

Finding

Skill Declares Unnecessary File-Write and Command-Execution Capabilities

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-22
Vulnerability Type: Excessive tool permissions and ambiguous duplicate configuration
Risk Level: Medium

Vulnerable Configuration:

yaml

tools:
- - read
- exec
homepage: https://skillhub.cn
pricing_tier: "L1-入门级"
pricing_model: per_use
suggested_price: "9.9 CNY/per_use"
tools: ["read", "write", "exec"]

Technical Analysis

The skill identifies itself as a Markdown reference guide whose primary purpose is to provide CSV-processing guidance. Nevertheless, its metadata requests exec and, in the second declaration, write. These capabilities exceed what is necessary to present documentation or inspect CSV content.

The metadata also defines the tools key twice. YAML parsers handle duplicate keys inconsistently: some reject them, some retain the first value, and others silently retain the last value. Consequently, the effective permission set may be ambiguous and may include both arbitrary command execution and file modification.

No malicious command is embedded in the audited file. The risk arises from granting capabilities beyond the documented task requirements, increasing the consequences of later prompt injection, unsafe user instructions, or accidental tool invocation.

Attack Path

1. The platform loads the skill and interprets the duplicate tools declarations.
2. A parser that retains the final declaration grants read, write, and exec.
3. The agent processes attacker-controlled CSV content or untrusted task instructions.
4. Malicious content attempts to influence the agent into invoking a granted tool.
5. Because command execution and file writing are available, a successful instruction-manipulation attack can affect local files or execute commands beyond the needs of CSV guidance.

This is a privilege-amplification condition rather than evidence that the skill itself currently executes a malicious paylo ...[truncated 421 chars]

Remediation

View remediation

Remediation Suggestions

• Remove exec because arbitrary command execution is not required for a documentation-oriented CSV reference skill.
• Remove write from the default permission set unless the user explicitly requests an export operation.
• Default to read only and request narrowly scoped write access for a specific destination when necessary.
• Declare the tools key exactly once using valid, unambiguous YAML.
• If example execution is supported, expose a constrained CSV-processing operation instead of a general-purpose shell.
• Restrict accessible paths, permitted commands, output destinations, file sizes, and execution time at the platform level.
• Require explicit user confirmation before writing files or running optional examples.
• Add metadata validation that rejects duplicate YAML keys and permissions unsupported by the skill's declared functionality.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger condition says the skill should be used for security detection, compliance audit, vulnerability scanning, and encryption protection, which is unrelated to the stated CSV guidance purpose. Overbroad and mismatched triggers can cause this skill to activate in sensitive security workflows where it is not appropriate, creating confusion, bad guidance, and possible unsafe tool use under false pretenses.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as a Markdown reference guide, yet it also claims operational capabilities such as create, export, modify, reset, import, save, and convert. This mismatch can mislead an agent into granting the skill broader authority than users expect, increasing the risk of unintended file or command actions when the manifest also exposes read/write/exec tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation advertises actions like create, export, save, modify, reset, and import, all of which may alter or overwrite user data, but it provides no warnings, confirmation requirements, rollback guidance, or scope limits. In a skill that also declares write and exec tools, this omission raises the chance of accidental destructive actions or unsafe automation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill claims to be pure Markdown with no extra API key, but elsewhere includes execution-oriented troubleshooting such as running ping and handling firewall/proxy connectivity. This inconsistency can cause an agent or user to treat a passive reference skill as one that is expected to execute system or network commands, which expands operational risk without clear justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

L005-L006 使用中文名称和中文摘要，全文也默认以中文提供说明，但没有说明这是面向特定中文用户群体的地区化技能，也没有提供语言选择或用户选择入口。按规则，这构成未经用户选择即固定语言/locale 的自然语言策略问题。

Content

No source excerpt is available for this finding.