Data Visualizer

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a local terminal charting helper; the main things to notice are that it runs a bundled shell/Python script, reads files you point it at, and may keep a local history log.

Before installing, confirm you are comfortable with a local shell/Python charting script that reads the CSV or JSON files you specify and may keep a local history log. Avoid pointing it at sensitive files unless you intend their contents or summaries to be shown, and clear or relocate the history directory if needed.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If used on private CSV or JSON files, their contents, structure, or statistics may appear in the terminal or agent conversation.

Why it was flagged

The skill intentionally accepts local data files and can print summaries or generate exports. This is expected for the charting purpose, but it means the agent should only be directed at files the user intends to process.

Skill content
`matrix <file>`, `summarize <file>`, `from-json <file>`, `to-svg`, `to-html`
Recommendation

Use the commands only with intended datasets, and review generated SVG/HTML or terminal output before sharing it.

What this means

Installing or invoking the skill allows the agent to run the bundled local script for charting and data-processing tasks.

Why it was flagged

The skill runs a bundled Bash script and inline Python for CSV/JSON processing. This local code execution is central to the stated terminal visualization purpose and is not shown as hidden, remote, or unrelated.

Skill content
#!/usr/bin/env bash ... INPUT_FILE="$file" python3 << 'PYEOF'
Recommendation

Keep usage limited to the documented commands and ensure bash/python3 are acceptable in your environment.

What this means

Local history may remain after use and could expose which datasets were processed on the machine.

Why it was flagged

The skill discloses persistent local storage for history. That is not inherently unsafe, but command history may reveal file names or usage patterns.

Skill content
`DATAVIZ_DIR` ... default: `~/.local/share/data-visualizer/`; History logged in `~/.local/share/data-visualizer/history.log`.
Recommendation

Set `DATAVIZ_DIR` to a suitable location or periodically clear the history log if working with sensitive datasets.