happytails.ai

CSV formula injection checker

Open CSV formula injection checker on Happytails.ai. This view has the same page content and links, with explicit tool capabilities. Read the processing notes before using a tool.

Tool capabilities

{
  "id": "csv-formula-injection-checker",
  "category": "data-tools",
  "built": true,
  "requirements": "Paste a CSV to inspect its headers and data cells. The checker flags potentially executable prefixes such as =, +, - and @, related fullwidth characters and leading control characters. The findings table shows the record number, column number, column name, original string and reason. Record 0 is the header. A flagged string is not proof that a spreadsheet will execute it. Legitimate negative numbers can be flagged. Conversely, this check cannot guarantee that a file is safe in every spreadsheet or import workflow. Quoting CSV cells alone does not neutralize formulas, and spreadsheet applications can interpret or alter escaping differently. The default main CSV prefixes detected strings with an apostrophe. This is a mitigation, not a universal spreadsheet safety guarantee, and it changes the affected cell strings. Preserve original cells is available for trusted machine processing. The separate findings CSV always prefixes potentially executable values; the JSON report records the choice and counts.",
  "implementation": {
    "fields": [
      {
        "key": "delimiter",
        "label": "Input CSV separator",
        "value": ",",
        "type": "select",
        "values": [
          ",",
          ";",
          "\t"
        ]
      },
      {
        "key": "exportMode",
        "label": "Spreadsheet formula handling",
        "value": "Protect formulas",
        "type": "select",
        "values": [
          "Protect formulas",
          "Preserve original cells"
        ]
      }
    ],
    "live": true,
    "presentation": "metrics",
    "note": "Inspect headers and cells for potentially executable spreadsheet prefixes, including leading control characters. The findings CSV identifies every flagged cell; record 0 is the header. Legitimate negative numbers may be flagged. Quoting alone does not neutralize formulas, and spreadsheet import settings vary. Use a header row with unique column names. Up to 1,000,000 input characters, 10,000 data records, 100 columns and 100,000 cells. Strings and spaces are preserved. Output CSV uses commas and quotes every cell. Protect formulas prefixes risky output cells with an apostrophe; choose Preserve original cells only for trusted machine processing. Runs on your device.",
    "experience": {
      "automatic": true,
      "single": false,
      "inputMaxLength": 1000000,
      "inputMode": "text",
      "label": "CSV",
      "placeholder": "name,score\nAda,98\nSam,92",
      "help": "Include a header row. Quote cells that contain commas or new lines. Results update as you type. Up to 1,000,000 characters.",
      "helpParts": [
        "Include a header row. Quote cells that contain commas or new lines.",
        "Results update as you type.",
        "Up to 1,000,000 characters."
      ],
      "action": null
    },
    "mode": "automatic",
    "interactive": false
  },
  "execution": "Browser interface",
  "api": null,
  "browser_agent": {
    "supported": true,
    "name": "run_current_tool",
    "discovery": "WebMCP on the human page in a supporting browser",
    "verification": "See audit/API-AUDIT.md; availability is not verification"
  }
}

Page guide

Find CSV cells with potentially executable spreadsheet prefixes. Review their locations and download a findings report.

How to use CSV formula injection checker
  1. Paste CSV with unique headers and choose its separator.
  2. Inspect every flagged location and decide whether the string is expected.
  3. Choose formula handling and download the main CSV, findings CSV and report.

Useful next steps

CSV row filterDataset value mapperCSV deterministic samplerCSV to JSON

What to expect

Find CSV cells with potentially executable spreadsheet prefixes. Review their locations and download a findings report. Paste a CSV to inspect its headers and data cells. The checker flags potentially executable prefixes such as =, +, - and @, related fullwidth characters and leading control characters. The findings table shows the record number, column number, column name, original string and reason. Record 0 is the header. A flagged string is not proof that a spreadsheet will execute it. Legitimate negative numbers can be flagged. Conversely, this check cannot guarantee that a file is safe in every spreadsheet or import workflow. Quoting CSV cells alone does not neutralize formulas, and spreadsheet applications can interpret or alter escaping differently. The default main CSV prefixes detected strings with an apostrophe. This is a mitigation, not a universal spreadsheet safety guarantee, and it changes the affected cell strings. Preserve original cells is available for trusted machine processing. The separate findings CSV always prefixes potentially executable values; the JSON report records the choice and counts.

Try a small example

value,note
=2+2,formula
-42,may be a legitimate number
safe,plain text