survival-curve-risk-table
Warn
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The
scripts/main.pyscript utilizespd.read_pickle()to load data files. This method of deserialization is inherently unsafe as it allows for the execution of arbitrary Python code if a malicious.pklor.picklefile is provided to the script. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data files (CSV, Excel, SAS) which provides a surface for indirect prompt injection if the agent interprets content from these files as instructions.
- Ingestion points: The
load_data_from_filemethod inscripts/main.pyingests data from CSV, Excel, SAS, and Pickle files. - Boundary markers: Absent. There are no instructions or delimiters implemented to prevent the agent from following instructions embedded within the data files.
- Capability inventory: The skill possesses file-writing capabilities via
matplotlib.pyplot.savefig()andpandas.DataFrame.to_csv()inscripts/main.py. - Sanitization: Absent. The data loaded from external sources is processed without sanitization or validation of its content for malicious instructions.
Audit Metadata