sympy

Warn

Audited by Gen Agent Trust Hub on Jul 13, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill documents the use of sympy.parsing.sympy_parser.parse_expr to convert strings into symbolic expressions. In references/code-generation-printing.md, it provides an 'Interactive Computation' pattern that demonstrates passing direct output from input() into parse_expr(). Because this function can evaluate arbitrary Python code by default, it poses a risk of code execution if applied to unsanitized user strings.
  • [COMMAND_EXECUTION]: In references/code-generation-printing.md, the skill describes using pickle.load() to restore SymPy objects from files. The pickle module is inherently unsafe and can execute arbitrary code during the deserialization of data from an untrusted source.
  • [COMMAND_EXECUTION]: The skill includes instructions for dynamic code generation and execution using lambdify, autowrap, and ufuncify. These tools generate Python functions or compile C/Fortran code at runtime to optimize mathematical performance, which involves dynamic execution of generated logic.
  • [EXTERNAL_DOWNLOADS]: The skill references and links to official documentation and source code repositories for SymPy, specifically docs.sympy.org and github.com/sympy/sympy. These are established and well-known resources in the scientific computing community.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 13, 2026, 10:21 AM