csv-xlsx-import-export-weapon
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data (CSV and XLSX files). However, it mitigates this risk by providing extensive documentation and code for validation and sanitization.
- Ingestion points: User-provided files are processed in components such as
examples/papaparse-chunked-worker.tsxandexamples/sheetjs-webworker-xlsx.ts. - Boundary markers: The skill recommends using explicit delimiters and Zod schemas to validate data structure and content immediately after parsing.
- Capability inventory: The skill facilitates file parsing (via Papaparse, SheetJS, and ExcelJS) and database insertion (as demonstrated in
guides/03-validation-rules.md). - Sanitization: A dedicated guide (
guides/04-csv-injection-prevention.md) and canonical code example (examples/csv-injection-sanitize.ts) provide robust protection against formula injection by prepending tab characters to dangerous prefixes and setting restrictive HTTP headers. - [COMMAND_EXECUTION]: The skill demonstrates safe command execution patterns for server-side processing, specifically focusing on streaming data from databases to file exports without loading entire datasets into memory, which prevents denial-of-service (OOM) conditions.
- [EXTERNAL_DOWNLOADS]: The skill references several well-known and trusted external services and libraries for spreadsheet handling, including SheetJS, Papaparse, ExcelJS, Flatfile, OneSchema, and Dromo. These references are used for documentation and pricing comparisons and do not involve untrusted remote code execution.
Audit Metadata