dataset-finder

Pass

Audited by Gen Agent Trust Hub on Sep 7, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of an external third-party tool called OpenClawCLI from clawhub.ai.
  • Evidence: Found in the YAML frontmatter description and the Troubleshooting section pointing to https://clawhub.ai/.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external repositories that could contain malicious instructions designed to influence the agent's behavior during previews or documentation generation.
  • Ingestion points: Dataset files (CSV, JSON, JSONL, Parquet, etc.) downloaded from repositories like Kaggle, Hugging Face, UCI, and Data.gov, which are then processed by the preview and datacard commands in scripts/dataset.py.
  • Boundary markers: The instructions lack explicit delimiters or guidance to the agent to ignore instructions embedded within the data content.
  • Capability inventory: The skill environment includes file system write access (via --output flags), reading of local files, and network communication for downloads.
  • Sanitization: No evidence of input sanitization, content filtering, or validation is provided for the data being parsed and summarized.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 7, 2026, 06:48 AM