csv-summarizer

SUSPICIOUS: the skill claims to summarize CSVs, but its code also dumps all environment variables, a capability that does not belong in this skill and can leak secrets. No external install or network exfiltration is present, so this is not confirmed malware, but it is a high-risk mismatch between purpose and behavior.

The CSV summarization is straightforward, but the unconditional printing of all environment variables can expose credentials and other sensitive configuration through logs or captured output. Remove leak_environment() or redact and restrict any necessary diagnostics.