# Data Tools

> A small, safe data helper — runs a fixed command, parses JSON, reads YAML safely. Demonstrates Python that the AST pass should NOT flag.

- Skill: `antoniotimo/data-tools` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add antoniotimo/data-tools`
- Raw SKILL.md: https://api.skillmd.com/api/skills/antoniotimo/data-tools/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: AntonioTimo (https://skillmd.com/u/antoniotimo)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/antoniotimo/data-tools

---


# Data Tools

A safe helper. Every potentially risky call is written the safe way, so neither
the regex pass nor the AST pass flags it.

## Step 0 — Validate

```bash
P="$1"
test -e "$P" || { echo "NOT_FOUND: $P"; exit 1; }
```

## Step 1 — Run

```bash
python3 ~/.claude/skills/data-tools/scripts/safe.py "$P"
```

---

## Why this passes audit (negative test for the AST pass)

`scripts/safe.py` uses the safe form of every pattern the AST pass watches:

- `subprocess.run(["ls", "-l"], timeout=10)` — argument list, no `shell=True`
- `json.loads(text)` — not `pickle` / `marshal`
- `yaml.safe_load(text)` — not `yaml.load`
- `getattr(obj, "name", None)` — a literal attribute, not dynamic dispatch

Expected verdict: 🟢 GREEN, exit 0.