csv-data-summarizer

Pass

Audited by Gen Agent Trust Hub on Aug 21, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The SKILL.md file contains forceful instructions designed to override the agent's natural conversational flow. It uses aggressive language like "⚠️ CRITICAL BEHAVIOR REQUIREMENT ⚠️", "DO NOT ASK THE USER WHAT THEY WANT", and "FORBIDDEN BEHAVIORS" to ensure the agent performs analysis immediately and automatically without seeking user direction or offering choices.- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted CSV data which is then summarized and reflected back into the agent's context.
    • Ingestion points: The summarize_csv function in analyze.py reads user-provided CSV files using pandas.
    • Boundary markers: The instructions lack delimiters or safety warnings to prevent the agent from following instructions that might be embedded within the CSV data.
    • Capability inventory: The skill can generate and save multiple image files to the local disk based on data attributes.
    • Sanitization: The data is processed and displayed (e.g., top categorical values) without any escaping or validation against malicious instruction patterns.- [EXTERNAL_DOWNLOADS]: The documentation provides links to download the skill's source code and sample data from a GitHub repository.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 21, 2026, 05:04 AM
Security Audit — agent-trust-hub — csv-data-summarizer