vedic-calculator

Pass

Audited by Gen Agent Trust Hub on Nov 5, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts setup_env.py and check_env.py use subprocess.run to create a virtual environment, upgrade pip, install dependencies, and run Python snippets for environment verification.
  • [EXTERNAL_DOWNLOADS]: During environment setup, setup_env.py installs several Python packages (pysweph, PyJHora, numpy, etc.) via pip and downloads ephemeris data files (.se1) from the official Swiss Ephemeris server (astro.com) if they are missing locally.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data (birth date, time, and location). While the backend script engine.py validates and converts these to numeric values for astronomical calculations, the ingestion point exists.
  • Ingestion points: Birth details provided via chat in SKILL.md.
  • Boundary markers: Not present in prompt instructions.
  • Capability inventory: Network access for data fetching and shell command execution for setup.
  • Sanitization: Inputs are processed by Python's type conversion (int/float) before calculation in engine.py.
  • [DYNAMIC_EXECUTION]: The skill performs dynamic path manipulation by appending directories to sys.path in several scripts (e.g., ashtakavarga_pyjhora.py) to locate the jhora library. Additionally, check_env.py executes dynamically constructed Python code strings using subprocess.run to verify dependency versions.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 5, 2026, 02:59 PM