A customer export goes to a vendor, and nobody noticed the card_number column, the password hashes, or a "name" that a visitor typed as =HYPERLINK(...), which can run as a formula when someone opens the CSV in Excel. This skill finds those before the file leaves your hands, and tells you in plain words what to remove or fix.

Your agent runs a scanner on a file or a whole folder of .csv, .tsv, .jsonl and .xlsx files. It works out the separator by itself (comma, semicolon, tab or |), reads files saved by Excel (with a BOM, UTF-16, or quoted values that hold commas and line breaks), and reads every worksheet of an .xlsx workbook, hidden ones included. Each finding names the file, the column and the cells as you see them in Excel (C7) or the JSONL line, with a count, the reason and a safer approach. It never prints what is in a cell, never changes the file and never uses the network. It returns BLOCK, REVIEW, or NOT FLAGGED.

What it checks

BLOCK (fix before shipping)

• D01: cells that start with = + - @ and call a function or another program (CSV formula injection, DDE)

• D02: payment card numbers that pass the Luhn check and fit a real card range, length and grouping

• D03: IBANs with the right length for their country and valid check digits

• D04: columns of passwords, password hashes, API keys or tokens, and keys in known formats

REVIEW (check before release)

• D11: email addresses, counted per column

• D12: phone numbers (phone-named columns and +country numbers)

• D13: national ID numbers (US SSN, UK National Insurance, passport and ID columns)

• D14: rows that repeat exactly, and repeated values in an ID column

• D15: rows with the wrong number of columns, unclosed quotes, lines that are not valid JSON

• D16: one column with dates in several formats (2024-03-01 next to 03/01/2024, day-first next to month-first)

• D17: header problems: missing or repeated names, extra spaces, no header row

• D18: files larger than the scanner reads (more than 100,000 rows)

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe set of sample exports (CSV, TSV and JSONL), and the real report the scanner produces on the risky set

Limits

It reads the first 100,000 rows of each file or worksheet (at most 2,000,000 cells) and says so when a file has more. .xlsx files over 50 MB, old .xls, password-protected workbooks, .ods and JSON array files are not read. Names, street addresses and dates of birth written as free text are not detected. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 15 files: SKILL.md, the scanner in scripts/ (4 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (8 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.