sympy
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill documents the use of SymPy's code generation and compilation utilities, specifically
autowrapandufuncify. These functions generate C or Fortran code from symbolic expressions and compile them into executable Python extensions at runtime to improve performance. - [DYNAMIC_EXECUTION]: The skill provides examples for using
parse_expr,parse_latex, andparse_mathematica. These utilities dynamically interpret string input to create symbolic expression trees, which represents a form of dynamic logic generation. - [DYNAMIC_EXECUTION]: The reference materials include examples of using the
picklemodule to save and load SymPy objects. This is a standard serialization method, though the documentation notes that it should be handled with care regarding untrusted data. - [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface where an agent might ingest untrusted string data and process it via mathematical parsers (e.g.,
Pattern 3: Interactive Computation). The documentation acknowledges this risk by explicitly instructing the user to validate and sanitize input to avoid code injection vulnerabilities.
Audit Metadata