Skills
Navigate
skills/code-yeongyu/oh-my-openagent/data-scientist/Gen Agent Trust Hub

data-scientist

Fail

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill fetches and executes the official installation script for the uv tool from the well-known domain astral.sh. While this is a common installation pattern for developer tools, it involves piping remote content directly to a shell interpreter.
  • Evidence: scripts/setup-uv.sh uses curl -LsSf https://astral.sh/uv/install.sh | sh and wget -qO- https://astral.sh/uv/install.sh | sh.
  • [PRIVILEGE_ESCALATION]: The setup script for Windows environments utilizes an execution policy bypass to allow the installation of the uv binary.
  • Evidence: scripts/setup-uv.ps1 executes powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex".
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data files (CSV, Parquet, JSON, NDJSON) without explicit boundary markers to prevent the interpretation of embedded instructions. The skill has significant capabilities that could be targeted if malicious data is processed.
  • Ingestion points: scripts/quick-query.py and various data exploration patterns described in SKILL.md.
  • Boundary markers: Absent. There are no instructions for the agent to disregard instructions found within the data files.
  • Capability inventory: The skill can execute shell commands via subprocess.run, perform network requests through the DuckDB httpfs extension, and modify the local filesystem in the $HOME/.cache/omo-data-scientist directory.
  • Sanitization: Absent. The skill passes data paths and query structures directly to the underlying processing libraries.
  • [DYNAMIC_EXECUTION]: The skill dynamically modifies the Python sys.path at runtime to inject and load dependencies installed in a user-level cache directory.
  • Evidence: scripts/ensure-py-deps.sh and references/execution-surfaces.md describe using sys.path.insert(0, site) to load polars and pyarrow.
  • [COMMAND_EXECUTION]: The skill makes extensive use of subprocess calls to perform environment discovery (e.g., checking OS architecture) and manage tool installation.
  • [EXTERNAL_DOWNLOADS]: Initialization scripts download and install packages from official registries (NPM and PyPI) to a persistent local cache.
  • Evidence: scripts/ensure-js-deps.sh installs @duckdb/node-api; scripts/ensure-py-deps.sh installs polars and pyarrow.
Recommendations
  • HIGH: Downloads and executes remote code from: https://astral.sh/uv/install.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 8, 2026, 05:14 AM
Security Audit — agent-trust-hub — data-scientist