vedic-calculator
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The scripts
setup_env.pyandcheck_env.pyusesubprocess.runto create a virtual environment, upgrade pip, install dependencies, and run Python snippets for environment verification. - [EXTERNAL_DOWNLOADS]: During environment setup,
setup_env.pyinstalls several Python packages (pysweph, PyJHora, numpy, etc.) via pip and downloads ephemeris data files (.se1) from the official Swiss Ephemeris server (astro.com) if they are missing locally. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data (birth date, time, and location). While the backend script
engine.pyvalidates and converts these to numeric values for astronomical calculations, the ingestion point exists. - Ingestion points: Birth details provided via chat in
SKILL.md. - Boundary markers: Not present in prompt instructions.
- Capability inventory: Network access for data fetching and shell command execution for setup.
- Sanitization: Inputs are processed by Python's type conversion (int/float) before calculation in
engine.py. - [DYNAMIC_EXECUTION]: The skill performs dynamic path manipulation by appending directories to
sys.pathin several scripts (e.g.,ashtakavarga_pyjhora.py) to locate thejhoralibrary. Additionally,check_env.pyexecutes dynamically constructed Python code strings usingsubprocess.runto verify dependency versions.
Audit Metadata