sympy
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONNO_CODE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides examples of using
parse_expr()to evaluate strings provided viainput()inreferences/code-generation-printing.md. This function parses and evaluates expressions at runtime, which can lead to arbitrary code execution if used on untrusted data. - [COMMAND_EXECUTION]: Examples in
references/code-generation-printing.mddemonstrate the use ofpickle.load()for loading serialized SymPy objects. This is a known unsafe deserialization pattern that can result in command execution if the loaded file is malicious. - [COMMAND_EXECUTION]: The documentation covers several dynamic code execution tools provided by SymPy, such as
lambdify,autowrap, andufuncify, which generate and execute Python, C, or Fortran code at runtime to improve performance. - [SAFE]: The skill contains no executable code or scripts, consisting solely of Markdown documentation and code snippets for instructional purposes.
- [SAFE]: All external links and references point to legitimate domains such as the official SymPy documentation and GitHub repositories.
Audit Metadata