csv-llm-edit

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs capturing the CSV as a TOON block and embedding it in the LLM prompt (then asking the LLM to return modified TOON or code), which would require the model to see and potentially reproduce CSV field values verbatim — risking exfiltration of any secrets contained in the CSV.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The codebase intentionally executes user- or LLM-provided Python code via exec() (with full builtins available) and documents a workflow where an LLM returns code to be executed, enabling remote code execution and easy data exfiltration or credential access if untrusted inputs are used.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Workflow B reads the operating user’s input CSV (outsider-provided file content) via scripts/csv_to_toon.py and then embeds the resulting TOON text into the LLM prompt ({toon_block}), so outsider-authored free text can reach the LLM context.