Security audit

Csv Brain

Security checks for vulnerabilities and agentic risk

Overview

CSVBrain is a coherent CSV analysis helper, but users should treat its AI query mode as a data-sharing feature because it sends dataset summaries and sample rows to the configured model provider.

Install only if you are comfortable with the configured AI provider receiving column names, statistics, the first five rows, and your questions. Use local Ollama or an approved provider for sensitive data, avoid untrusted OLLAMA_HOST values, and verify AI-generated answers before relying on them for important decisions.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: src/csv-brain.js:112
Finding: Configurable Ollama Endpoint Enables SSRF and Dataset Disclosure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/csv-brain.js:110
Finding: Untrusted CSV Content Is Embedded in a Privileged Model Prompt
Content: View full analysis
, <, >=, <=, =, contains. 3. If no structured query applies, set "query" to null. 4. Put any supporting data (arrays, objects, values) in the "data" field, or null if not applicable. You MUST respond with valid JSON only, no markdown, no code fences, no extra text. Use this exact format: {"answer": "your plain English answer here", "data": null, "query": null}`; const userMessage = question; ``` The resulting model response is accepted with only JSON parsing: ```javascript const obj = JSON.parse(cleaned); return { ...[truncated 2429 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README states that data is not transmitted externally unless explicitly configured by the user, but the skill description advertises Anthropic and OpenAI-backed natural-language querying. That creates a deceptive privacy/security representation: users may supply sensitive CSV data believing it stays local when prompts or data may be sent to third-party APIs during normal use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill prominently advertises natural-language querying via Anthropic, OpenAI, or Ollama, but the description does not clearly warn that dataset-derived content is sent to third-party AI services when remote providers are used. Even though the limitations section later notes that profiles and sample rows are transmitted, users may invoke the feature without realizing potentially sensitive business or personal data is leaving their environment, creating a meaningful data disclosure and compliance risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The system prompt automatically embeds sample rows and detailed column profiles derived from the loaded CSV before sending the prompt to an LLM. In a data-query skill, this context is functionally useful, but it also directly increases the volume and sensitivity of data disclosed externally, especially if the CSV contains PII, financial records, or proprietary business data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The ask() method sends user questions plus dataset-derived context, including headers, column statistics, and sample rows, to external providers such as Anthropic. This creates a real data exfiltration/privacy risk because potentially sensitive CSV contents are transmitted off-host without explicit consent, redaction, or any built-in disclosure/warning mechanism.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The OpenAI path transmits the constructed prompt containing dataset metadata, statistics, sample rows, and the user's question to api.openai.com. If the CSV contains secrets, personal data, or regulated information, this can disclose sensitive content to a third party by default during natural-language querying.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The Ollama integration defaults to http://localhost:11434 and allows arbitrary OLLAMA_HOST values; if configured to a non-local endpoint over HTTP, dataset content and questions are sent unencrypted. That creates both confidentiality risk from plaintext transit and SSRF-like risk if untrusted input can control ollamaHost or environment configuration.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · README.md (reported line 50)May include surrounding context.
md
**USE AT YOUR OWN RISK.** - The author(s) are NOT liable for any damages, losses, or consequences arising from the use or misuse of this software — including but not limited to financial loss, data loss, security breaches, business interruption, or any indirect/consequential damages. - This software does NOT constitute financial, legal, trading, or professional advice. - Users are solely responsible for evaluating whether this software is suitable for

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The code reads provider API keys from environment variables for Anthropic and OpenAI, but there is no visible user notice, comment, or docstring explaining that credentials will be accessed from the environment. This meets the rule's criterion for sensitive environment variable access lacking disclosure.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.