sympy
Warn
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the use of
sympy.parsing.sympy_parser.parse_exprto convert strings into symbolic expressions. Inreferences/code-generation-printing.md, it provides an 'Interactive Computation' pattern that demonstrates passing direct output frominput()intoparse_expr(). Because this function can evaluate arbitrary Python code by default, it poses a risk of code execution if applied to unsanitized user strings. - [COMMAND_EXECUTION]: In
references/code-generation-printing.md, the skill describes usingpickle.load()to restore SymPy objects from files. Thepicklemodule is inherently unsafe and can execute arbitrary code during the deserialization of data from an untrusted source. - [COMMAND_EXECUTION]: The skill includes instructions for dynamic code generation and execution using
lambdify,autowrap, andufuncify. These tools generate Python functions or compile C/Fortran code at runtime to optimize mathematical performance, which involves dynamic execution of generated logic. - [EXTERNAL_DOWNLOADS]: The skill references and links to official documentation and source code repositories for SymPy, specifically
docs.sympy.organdgithub.com/sympy/sympy. These are established and well-known resources in the scientific computing community.
Audit Metadata