networkx
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The documentation includes examples of using 'pickle' and 'gpickle' for graph serialization. These methods perform unsafe deserialization of data, which can lead to arbitrary code execution if the input originates from an untrusted source. Users should prefer safer formats like JSON or GraphML.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides tools for reading data from various external file formats and databases, creating a surface for indirect prompt injection. If an agent processes maliciously crafted graph data without sanitization, it could influence the agent's logic.\n
- Ingestion points: 'references/io.md' (e.g., nx.read_graphml, nx.read_edgelist, pd.read_sql_query).\n
- Boundary markers: Absent.\n
- Capability inventory: File system access and subprocess execution (Graphviz).\n
- Sanitization: None provided.\n- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install third-party Python packages including 'networkx', 'pandas', 'numpy', 'scipy', and visualization libraries like 'plotly' and 'pyvis'. These are well-known and reputable packages.
Audit Metadata