dataset-finder
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of an external third-party tool called
OpenClawCLIfromclawhub.ai. - Evidence: Found in the YAML frontmatter description and the Troubleshooting section pointing to
https://clawhub.ai/. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external repositories that could contain malicious instructions designed to influence the agent's behavior during previews or documentation generation.
- Ingestion points: Dataset files (CSV, JSON, JSONL, Parquet, etc.) downloaded from repositories like Kaggle, Hugging Face, UCI, and Data.gov, which are then processed by the
previewanddatacardcommands inscripts/dataset.py. - Boundary markers: The instructions lack explicit delimiters or guidance to the agent to ignore instructions embedded within the data content.
- Capability inventory: The skill environment includes file system write access (via
--outputflags), reading of local files, and network communication for downloads. - Sanitization: No evidence of input sanitization, content filtering, or validation is provided for the data being parsed and summarized.
Audit Metadata