timesfm-forecasting

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/check_system.py executes standard system utilities (sysctl, vm_stat) on macOS to determine hardware resource availability. This is a safety feature intended to prevent the AI agent from crashing the user's machine by loading a model that exceeds available RAM.
  • [DYNAMIC_EXECUTION]: The diagnostic script scripts/check_system.py uses the __import__ function to programmatically verify the presence and version of required Python libraries such as torch and timesfm.
  • [EXTERNAL_DOWNLOADS]: The skill orchestrates the download of pre-trained model weights from the Hugging Face Hub (e.g., google/timesfm-2.5-200m-pytorch). It also retrieves sample datasets from a public Amazon S3 bucket (autogluon.s3.amazonaws.com) for its fine-tuning examples. These downloads originate from well-known and reputable repositories.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides tools like scripts/forecast_csv.py that ingest data from external files. This creates a surface for indirect prompt injection where malicious instructions could be embedded in data fields.
  • Ingestion points: scripts/forecast_csv.py (reads user-supplied CSV files).
  • Boundary markers: Absent; numerical data is parsed directly into arrays.
  • Capability inventory: The skill can execute local Python scripts, perform file I/O, and generate visualizations.
  • Sanitization: Relies on standard numerical parsing by Pandas and Numpy; no specialized instruction filtering is applied to input data headers or contents.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 05:10 PM