marketing-mix-modeling-end-to-end-pipeline
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to clone a repository from an unverified third-party GitHub account (
francescaetnom-wq). This source is not recognized as a trusted organization or well-known service, and its connection to the skill author is not established. - [COMMAND_EXECUTION]: The installation guide requires executing shell commands, including
git cloneandpip install -r requirements.txt. Running these commands on resources from unverified external sources can lead to the installation of compromised dependencies or the execution of unvetted code. - [PROMPT_INJECTION]: The skill architecture presents a vulnerability surface for indirect prompt injection attacks.
- Ingestion points: The skill processes external data from
data/dt_simulated_weekly.csvusing thepandas.read_csvfunction. - Boundary markers: There are no boundary markers or instructions to treat ingested data as untrusted or to ignore embedded commands.
- Capability inventory: The skill possesses file-writing capabilities (
to_csv) and involves command execution for setup and optimization. - Sanitization: No input validation or content sanitization is performed on the ingested CSV data.
Audit Metadata