read-file
duckdb/duckdb-skills / skills/read-file
reads CSV, Parquet, Excel or remote URL , which improves: summarizes columns and rows without writing code
Details
- judge’s score
- 7/10
- place
- outside the packs
- publisher
- duckdb
- status
- new
- pinned commit
- 7feda8e on GitHub (new tab)
- skill’s last commit
- Mar 30, 2026
- repo stars
- 609
- main type
- Data
Judgement
Clear triggering and well-defined scope. Useful DuckDB macro, but unresolved RESOLVED_PATH placeholder, fragile monolithic macro and extensions not loaded. Score: 7 out of 10.
reservations
- The RESOLVED_PATH placeholder is never substituted: the bash command as written does not work without being rewritten by Claude.
- The read_any macro references all readers (xlsx, spatial, sqlite, avro) in a single definition, so the absence of one extension makes the whole macro fail; sqlite_master(file_name) is probably invalid syntax.
- The text "Filename given: $0" mixes skill argument syntax with pseudo-code, which makes the steps ambiguous.
- No appendix or test for the macro: the content cannot be verified beyond reading it.
- Triggering
- 2/2
- Added value
- 1/2
- Precision
- 1/2
- Scope
- 2/2
- Quality
- 1/2
Alerts
4 alerts, by category
Execution
- high risk
SQL injection: the file name or URL is interpolated directly into the DuckDB command, so a single quote in the argument breaks the query or injects another one.
- high risk
allowed-tools: Bash without restriction, with a find command on an unchecked file name.
Network
- high risk
The credential_chain provider sends local cloud credentials (S3, GCS, Azure) to a URL given as an argument, even if that URL comes from untrusted content.
Static scan
- info risk
allowed-tools frontmatter
Bash
Original description
Read any data file (CSV, JSON, Parquet, Avro, Excel, spatial, SQLite) or remote URL (S3, HTTPS). Use when user references a data file, asks "what's in this file", or wants to preview/profile a dataset. Not for source code.
added on Oct 19, 2026 · license MIT