astropy
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill describes functionality for fetching astronomical data and metadata from remote sources.
- Coordinate name resolution (
SkyCoord.from_name) uses services like Sesame, SIMBAD, and NED. - Location lookups (
EarthLocation.of_site,EarthLocation.of_address) may access remote registries or geocoding APIs. - Remote file access is supported for FITS data stored on S3 or via HTTP.
- Automatic updates for IERS Earth-rotation data may occur during high-precision time calculations.
- General-purpose file downloading is provided via
astropy.utils.data.download_file. - Documentation explicitly warns users about these network calls and provides methods to disable auto-downloads (e.g.,
iers.conf.auto_download = False). - [COMMAND_EXECUTION]: The installation section provides standard commands for package management.
- Instructions use
uv pip installwith pinned versions (e.g.,astropy==7.2.0) to ensure environment reproducibility. - [INDIRECT_PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection by processing external scientific data files.
- Ingestion points: Reading FITS images and headers, and various tabular formats (CSV, VOTable, HDF5) as documented in
references/fits.mdandreferences/tables.md. - Boundary markers: The instructions do not define specific delimiters for the agent when processing data from these files.
- Capability inventory: Includes file system read/write operations and network access for data retrieval described across several reference files.
- Sanitization: Relies on the library's native parsing of astronomical file formats.
Audit Metadata