publication-chart-skill

Pass

Audited by Gen Agent Trust Hub on May 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The helper script scripts/ensure_publication_tooling.py uses subprocess.run to execute package installation commands (pip or uv). This behavior is restricted to the skill's primary dependencies, 'pubfig' and 'pubtab', as defined in the script's DEFAULT_PACKAGES list.
  • [EXTERNAL_DOWNLOADS]: The skill is designed to automatically download and install the 'pubfig' and 'pubtab' libraries from the Python Package Index (PyPI) if they are missing from the environment. This is a legitimate functional requirement for the skill's operation.
  • [COMMAND_EXECUTION]: The script scripts/ensure_publication_tooling.py utilizes importlib.import_module to dynamically verify the availability of the required toolsets. The library names are validated against a predefined whitelist before loading.
Audit Metadata
Risk Level
SAFE
Analyzed
May 13, 2026, 11:27 PM
Security Audit — agent-trust-hub — publication-chart-skill