{
  "title": "CSV formula injection checker",
  "human_url": "https://happytails.ai/en/data-tools/csv-formula-injection-checker/",
  "agent_url": "https://happytails.ai/agents/en/data-tools/csv-formula-injection-checker/",
  "language": "en",
  "markdown_url": "https://happytails.ai/en/data-tools/csv-formula-injection-checker.md",
  "content": "CSV formula injection checker\nFind CSV cells with potentially executable spreadsheet prefixes. Review their locations and download a findings report.\nHow can we improve this tool?\nReport a problem or share an idea.\nPlease leave out private information. Your message and the tool name go to our team via PostHog.\nHow to use CSV formula injection checker\nPaste CSV with unique headers and choose its separator.\nInspect every flagged location and decide whether the string is expected.\nChoose formula handling and download the main CSV, findings CSV and report.\nUseful next steps\nCSV row filter\nDataset value mapper\nCSV deterministic sampler\nCSV to JSON\nWhat to expect\nFind CSV cells with potentially executable spreadsheet prefixes. Review their locations and download a findings report. Paste a CSV to inspect its headers and data cells. The checker flags potentially executable prefixes such as =, +, - and @, related fullwidth characters and leading control characters. The findings table shows the record number, column number, column name, original string and reason. Record 0 is the header. A flagged string is not proof that a spreadsheet will execute it. Legitimate negative numbers can be flagged. Conversely, this check cannot guarantee that a file is safe in every spreadsheet or import workflow. Quoting CSV cells alone does not neutralize formulas, and spreadsheet applications can interpret or alter escaping differently. The default main CSV prefixes detected strings with an apostrophe. This is a mitigation, not a universal spreadsheet safety guarantee, and it changes the affected cell strings. Preserve original cells is available for trusted machine processing. The separate findings CSV always prefixes potentially executable values; the JSON report records the choice and counts.\nTry a small example\nvalue,note\n=2+2,formula\n-42,may be a legitimate number\nsafe,plain text",
  "content_format": "text/plain",
  "visibility": "public",
  "links": [
    {
      "name": "CSV row filter",
      "url": "https://happytails.ai/en/data-tools/csv-row-filter/"
    },
    {
      "name": "Dataset value mapper",
      "url": "https://happytails.ai/en/data-tools/dataset-value-mapper/"
    },
    {
      "name": "CSV deterministic sampler",
      "url": "https://happytails.ai/en/data-tools/csv-deterministic-sampler/"
    },
    {
      "name": "CSV to JSON",
      "url": "https://happytails.ai/en/data-tools/csv-to-json/"
    }
  ],
  "tool": {
    "id": "csv-formula-injection-checker",
    "category": "data-tools",
    "built": true,
    "requirements": "Paste a CSV to inspect its headers and data cells. The checker flags potentially executable prefixes such as =, +, - and @, related fullwidth characters and leading control characters. The findings table shows the record number, column number, column name, original string and reason. Record 0 is the header. A flagged string is not proof that a spreadsheet will execute it. Legitimate negative numbers can be flagged. Conversely, this check cannot guarantee that a file is safe in every spreadsheet or import workflow. Quoting CSV cells alone does not neutralize formulas, and spreadsheet applications can interpret or alter escaping differently. The default main CSV prefixes detected strings with an apostrophe. This is a mitigation, not a universal spreadsheet safety guarantee, and it changes the affected cell strings. Preserve original cells is available for trusted machine processing. The separate findings CSV always prefixes potentially executable values; the JSON report records the choice and counts.",
    "implementation": {
      "fields": [
        {
          "key": "delimiter",
          "label": "Input CSV separator",
          "value": ",",
          "type": "select",
          "values": [
            ",",
            ";",
            "\t"
          ]
        },
        {
          "key": "exportMode",
          "label": "Spreadsheet formula handling",
          "value": "Protect formulas",
          "type": "select",
          "values": [
            "Protect formulas",
            "Preserve original cells"
          ]
        }
      ],
      "live": true,
      "presentation": "metrics",
      "note": "Inspect headers and cells for potentially executable spreadsheet prefixes, including leading control characters. The findings CSV identifies every flagged cell; record 0 is the header. Legitimate negative numbers may be flagged. Quoting alone does not neutralize formulas, and spreadsheet import settings vary. Use a header row with unique column names. Up to 1,000,000 input characters, 10,000 data records, 100 columns and 100,000 cells. Strings and spaces are preserved. Output CSV uses commas and quotes every cell. Protect formulas prefixes risky output cells with an apostrophe; choose Preserve original cells only for trusted machine processing. Runs on your device.",
      "experience": {
        "automatic": true,
        "single": false,
        "inputMaxLength": 1000000,
        "inputMode": "text",
        "label": "CSV",
        "placeholder": "name,score\nAda,98\nSam,92",
        "help": "Include a header row. Quote cells that contain commas or new lines. Results update as you type. Up to 1,000,000 characters.",
        "action": null
      },
      "mode": "automatic",
      "interactive": false
    },
    "execution": "Browser interface",
    "api": null,
    "browser_agent": {
      "supported": true,
      "name": "run_current_tool",
      "discovery": "WebMCP on the human page in a supporting browser",
      "verification": "See audit/API-AUDIT.md; availability is not verification"
    }
  },
  "markdown": "# CSV formula injection checker\n\n- Human page: https://happytails.ai/en/data-tools/csv-formula-injection-checker/\n- Markdown: https://happytails.ai/en/data-tools/csv-formula-injection-checker.md\n- Structured JSON: https://happytails.ai/agents/en/data-tools/csv-formula-injection-checker/index.json\n- Visibility: public\n\n## Tool capabilities\n\n| Property | Value |\n| --- | --- |\n| Tool ID | `csv-formula-injection-checker` |\n| Category | data-tools |\n| Implementation | Registered implementation. Registration alone is not a production-quality guarantee. |\n| Browser execution | Automatic updates after valid input or file selection. |\n| Browser processing | Browser; see tool notes for network behavior. |\n| HTTP API | Not callable through HTTP. |\n| Browser-agent interface | run_current_tool |\n\n### Implementation notes\n\nInspect headers and cells for potentially executable spreadsheet prefixes, including leading control characters. The findings CSV identifies every flagged cell; record 0 is the header. Legitimate negative numbers may be flagged. Quoting alone does not neutralize formulas, and spreadsheet import settings vary. Use a header row with unique column names. Up to 1,000,000 input characters, 10,000 data records, 100 columns and 100,000 cells. Strings and spaces are preserved. Output CSV uses commas and quotes every cell. Protect formulas prefixes risky output cells with an apostrophe; choose Preserve original cells only for trusted machine processing. Runs on your device.\n\n### Inputs and settings\n\nText input: CSV.\n\nExample or placeholder shown in the interface (not a validated fixture):\n\n```text\nname,score\nAda,98\nSam,92\n```\n\nInclude a header row. Quote cells that contain commas or new lines. Results update as you type. Up to 1,000,000 characters.\n\n| Setting | Meaning | Control type | Default | Constraints |\n| --- | --- | --- | --- | --- |\n| `delimiter` | Input CSV separator | select | \",\" | Allowed: ,, ;, \t |\n| `exportMode` | Spreadsheet formula handling | select | \"Protect formulas\" | Allowed: Protect formulas, Preserve original cells |\n\n### Browser-agent workflow\n\n1. Open the human page in a browser that supports WebMCP.\n2. Discover the interface exposed by that page; use its actual schema.\n3. Select files on the page first when the tool requires files.\n4. Call `run_current_tool` with valid input and settings.\n5. Inspect the returned result or error and the displayed output. Retrieve files from the displayed download links.\n\nCalls do not automatically copy or download results. Browser permissions still apply. Interface availability alone is not proof of successful execution.\n\n### Planning specification\n\nPaste a CSV to inspect its headers and data cells. The checker flags potentially executable prefixes such as =, +, - and @, related fullwidth characters and leading control characters. The findings table shows the record number, column number, column name, original string and reason. Record 0 is the header. A flagged string is not proof that a spreadsheet will execute it. Legitimate negative numbers can be flagged. Conversely, this check cannot guarantee that a file is safe in every spreadsheet or import workflow. Quoting CSV cells alone does not neutralize formulas, and spreadsheet applications can interpret or alter escaping differently. The default main CSV prefixes detected strings with an apostrophe. This is a mitigation, not a universal spreadsheet safety guarantee, and it changes the affected cell strings. Preserve original cells is available for trusted machine processing. The separate findings CSV always prefixes potentially executable values; the JSON report records the choice and counts.\n\nThis describes intended requirements. Use the implementation notes, interface schema and observed output to determine current support.\n\n### Complete machine-readable capability record\n\n```json\n{\n  \"id\": \"csv-formula-injection-checker\",\n  \"category\": \"data-tools\",\n  \"built\": true,\n  \"requirements\": \"Paste a CSV to inspect its headers and data cells. The checker flags potentially executable prefixes such as =, +, - and @, related fullwidth characters and leading control characters. The findings table shows the record number, column number, column name, original string and reason. Record 0 is the header. A flagged string is not proof that a spreadsheet will execute it. Legitimate negative numbers can be flagged. Conversely, this check cannot guarantee that a file is safe in every spreadsheet or import workflow. Quoting CSV cells alone does not neutralize formulas, and spreadsheet applications can interpret or alter escaping differently. The default main CSV prefixes detected strings with an apostrophe. This is a mitigation, not a universal spreadsheet safety guarantee, and it changes the affected cell strings. Preserve original cells is available for trusted machine processing. The separate findings CSV always prefixes potentially executable values; the JSON report records the choice and counts.\",\n  \"implementation\": {\n    \"fields\": [\n      {\n        \"key\": \"delimiter\",\n        \"label\": \"Input CSV separator\",\n        \"value\": \",\",\n        \"type\": \"select\",\n        \"values\": [\n          \",\",\n          \";\",\n          \"\\t\"\n        ]\n      },\n      {\n        \"key\": \"exportMode\",\n        \"label\": \"Spreadsheet formula handling\",\n        \"value\": \"Protect formulas\",\n        \"type\": \"select\",\n        \"values\": [\n          \"Protect formulas\",\n          \"Preserve original cells\"\n        ]\n      }\n    ],\n    \"live\": true,\n    \"presentation\": \"metrics\",\n    \"note\": \"Inspect headers and cells for potentially executable spreadsheet prefixes, including leading control characters. The findings CSV identifies every flagged cell; record 0 is the header. Legitimate negative numbers may be flagged. Quoting alone does not neutralize formulas, and spreadsheet import settings vary. Use a header row with unique column names. Up to 1,000,000 input characters, 10,000 data records, 100 columns and 100,000 cells. Strings and spaces are preserved. Output CSV uses commas and quotes every cell. Protect formulas prefixes risky output cells with an apostrophe; choose Preserve original cells only for trusted machine processing. Runs on your device.\",\n    \"experience\": {\n      \"automatic\": true,\n      \"single\": false,\n      \"inputMaxLength\": 1000000,\n      \"inputMode\": \"text\",\n      \"label\": \"CSV\",\n      \"placeholder\": \"name,score\\nAda,98\\nSam,92\",\n      \"help\": \"Include a header row. Quote cells that contain commas or new lines. Results update as you type. Up to 1,000,000 characters.\",\n      \"action\": null\n    },\n    \"mode\": \"automatic\",\n    \"interactive\": false\n  },\n  \"execution\": \"Browser interface\",\n  \"api\": null,\n  \"browser_agent\": {\n    \"supported\": true,\n    \"name\": \"run_current_tool\",\n    \"discovery\": \"WebMCP on the human page in a supporting browser\",\n    \"verification\": \"See audit/API-AUDIT.md; availability is not verification\"\n  }\n}\n```\n\n## Page guide\n\nFind CSV cells with potentially executable spreadsheet prefixes. Review their locations and download a findings report.\n\nHow can we improve this tool?\n\nReport a problem or share an idea.\n\nPlease leave out private information. Your message and the tool name go to our team via PostHog.\n\n### How to use CSV formula injection checker\n\n1. Paste CSV with unique headers and choose its separator.\n2. Inspect every flagged location and decide whether the string is expected.\n3. Choose formula handling and download the main CSV, findings CSV and report.\n\n## Useful next steps\n\n- [CSV row filter](https://happytails.ai/en/data-tools/csv-row-filter/) ([Markdown](https://happytails.ai/en/data-tools/csv-row-filter.md))\n\n- [Dataset value mapper](https://happytails.ai/en/data-tools/dataset-value-mapper/) ([Markdown](https://happytails.ai/en/data-tools/dataset-value-mapper.md))\n\n- [CSV deterministic sampler](https://happytails.ai/en/data-tools/csv-deterministic-sampler/) ([Markdown](https://happytails.ai/en/data-tools/csv-deterministic-sampler.md))\n\n- [CSV to JSON](https://happytails.ai/en/data-tools/csv-to-json/) ([Markdown](https://happytails.ai/en/data-tools/csv-to-json.md))\n\n## What to expect\n\nFind CSV cells with potentially executable spreadsheet prefixes. Review their locations and download a findings report. Paste a CSV to inspect its headers and data cells. The checker flags potentially executable prefixes such as =, +, - and @, related fullwidth characters and leading control characters. The findings table shows the record number, column number, column name, original string and reason. Record 0 is the header. A flagged string is not proof that a spreadsheet will execute it. Legitimate negative numbers can be flagged. Conversely, this check cannot guarantee that a file is safe in every spreadsheet or import workflow. Quoting CSV cells alone does not neutralize formulas, and spreadsheet applications can interpret or alter escaping differently. The default main CSV prefixes detected strings with an apostrophe. This is a mitigation, not a universal spreadsheet safety guarantee, and it changes the affected cell strings. Preserve original cells is available for trusted machine processing. The separate findings CSV always prefixes potentially executable values; the JSON report records the choice and counts.\n\n### Try a small example\n\n```\nvalue,note\n=2+2,formula\n-42,may be a legitimate number\nsafe,plain text\n```\n"
}