sympy

Pass

Audited by Gen Agent Trust Hub on Jun 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONNO_CODE
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides examples of using parse_expr() to evaluate strings provided via input() in references/code-generation-printing.md. This function parses and evaluates expressions at runtime, which can lead to arbitrary code execution if used on untrusted data.
  • [COMMAND_EXECUTION]: Examples in references/code-generation-printing.md demonstrate the use of pickle.load() for loading serialized SymPy objects. This is a known unsafe deserialization pattern that can result in command execution if the loaded file is malicious.
  • [COMMAND_EXECUTION]: The documentation covers several dynamic code execution tools provided by SymPy, such as lambdify, autowrap, and ufuncify, which generate and execute Python, C, or Fortran code at runtime to improve performance.
  • [SAFE]: The skill contains no executable code or scripts, consisting solely of Markdown documentation and code snippets for instructional purposes.
  • [SAFE]: All external links and references point to legitimate domains such as the official SymPy documentation and GitHub repositories.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 14, 2026, 08:50 AM
Security Audit — agent-trust-hub — sympy