meridian-budget-optimization
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Dynamic Code Generation and Execution: The skill is designed to accumulate code for a Python script based on user-provided parameters and then execute that script using the local Python interpreter. While executing generated code is a powerful capability, the skill manages the associated risks by including a 'Pre-execution Checkpoint' that requires the user to explicitly approve the script before it runs.
- Mandatory Interactive Checkpoints: A significant security feature of this skill is the requirement for multiple interactive checkpoints. The agent must pause and ask for user confirmation before configuring paths, setting optimization parameters, loading the model, and executing the final script. This ensures that the user retains control over the operations performed on their system.
- External Data Ingestion: The skill processes external data by loading serialized Meridian model files (
.binpb). This creates an entry point where data from a file influences the behavior of the analysis script. The skill mitigates this by using the specificmeridian_serdelibrary for loading and instructing the agent not to attempt to read or interpret the binary content directly. - Subprocess Execution: To run the generated optimization reports, the skill invokes the Python binary. It defaults to using the active virtual environment or a standard system path, which is a standard practice for development-oriented AI tools.
Audit Metadata