skills/ericmjl/skills/scientific-eda/Gen Agent Trust Hub

scientific-eda

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill generates disposable Python scripts within session-specific folders and executes them using the uv run command. This behavior leverages PEP723 inline metadata to declare and manage dependencies for each script, which is a modern security best practice for local script execution.\n- [COMMAND_EXECUTION]: The skill utilizes the uv run command to execute generated Python files. This capability allows the agent to perform data processing, visualization, and analysis on the local system.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted scientific data files (e.g., CSV, FASTA), creating a potential surface for indirect prompt injection if data content influences script generation.\n
  • Ingestion points: Scientific data files provided by the user (SKILL.md).\n
  • Boundary markers: The skill mandates a context-capturing phase and requires the agent to ask the user 'why' before performing any substantive action.\n
  • Capability inventory: The skill allows filesystem writes to session folders and script execution via uv.\n
  • Sanitization: Relies on human-guided alignment and explicit 'ask why' steps to validate intent before execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 11:18 AM