cli-anything-openrefine
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill requires a local installation of the agent harness using
python -m pip install -e .from the skill's own sub-directory. This is a standard installation procedure for a local tool and does not involve remote code downloads or execution from untrusted sources. - [DATA_EXFILTRATION]: Network operations are restricted to communication with the local loopback address (
127.0.0.1) on port 3333. No external network requests or data exfiltration patterns were observed. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data files (e.g., CSV/TSV) and applies transformation rules, which is an inherent part of its functionality.
- Ingestion points: Import of messy data files (e.g.,
messy.csv) via theproject importcommand inSKILL.md. - Boundary markers: No specific delimiters or safety warnings for the agent are included in the instructions.
- Capability inventory: The skill can read/write local files (
data export) and interact with a local network server. - Sanitization: The skill relies on OpenRefine's internal processing logic for data transformation.
Audit Metadata