math-computation
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The skill body contains a hardcoded absolute file path for a Python virtual environment activation script:
/Users/zhangmingda/clawd/.venv/bin/activate. This exposes the username 'zhangmingda' from the author's local environment, which is considered a metadata leak and poor practice for portable skills. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process mathematical expressions, equations, and models provided by the user or external data sources.
- Ingestion points: User-provided strings for equations, integrals, derivatives, and matrix operations defined in SKILL.md.
- Boundary markers: None identified in the provided instructions to differentiate user input from system logic.
- Capability inventory: The skill utilizes SymPy, NumPy, and SciPy to perform symbolic and numerical execution of code.
- Sanitization: There are no instructions for validating, escaping, or filtering user-provided mathematical strings before they are processed by the Python interpreter.
Audit Metadata