timesfm-forecasting
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/check_system.pyexecutes standard system utilities (sysctl,vm_stat) on macOS to determine hardware resource availability. This is a safety feature intended to prevent the AI agent from crashing the user's machine by loading a model that exceeds available RAM. - [DYNAMIC_EXECUTION]: The diagnostic script
scripts/check_system.pyuses the__import__function to programmatically verify the presence and version of required Python libraries such astorchandtimesfm. - [EXTERNAL_DOWNLOADS]: The skill orchestrates the download of pre-trained model weights from the Hugging Face Hub (e.g.,
google/timesfm-2.5-200m-pytorch). It also retrieves sample datasets from a public Amazon S3 bucket (autogluon.s3.amazonaws.com) for its fine-tuning examples. These downloads originate from well-known and reputable repositories. - [INDIRECT_PROMPT_INJECTION]: The skill provides tools like
scripts/forecast_csv.pythat ingest data from external files. This creates a surface for indirect prompt injection where malicious instructions could be embedded in data fields. - Ingestion points:
scripts/forecast_csv.py(reads user-supplied CSV files). - Boundary markers: Absent; numerical data is parsed directly into arrays.
- Capability inventory: The skill can execute local Python scripts, perform file I/O, and generate visualizations.
- Sanitization: Relies on standard numerical parsing by Pandas and Numpy; no specialized instruction filtering is applied to input data headers or contents.
Audit Metadata