umap-learn
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
umap-learnpackage and its optional dependencies (such as TensorFlow for Parametric UMAP) using standard Python package managers. These are well-known, legitimate libraries in the data science ecosystem. - [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection as it is designed to ingest and process external datasets for dimensionality reduction and clustering.
- Ingestion points: Data arrays passed to the
fit,fit_transform, andtransformmethods across all examples inSKILL.mdandreferences/api_reference.md. - Boundary markers: Absent; the skill expects pre-loaded numerical data without specific markers to distinguish between data and potential instructions.
- Capability inventory: Includes local file creation for visualizations (
plt.savefiginSKILL.md) and package installation instructions (pip installinSKILL.md). - Sanitization: Absent; while standard scaling (
StandardScaler) is used, it is intended for feature normalization rather than security-based sanitization of input data. - [DYNAMIC_EXECUTION]: The skill demonstrates the use of Numba-compiled custom distance metrics. Numba performs Just-In-Time (JIT) compilation of Python code into machine code to optimize performance. In the provided context, this is a standard application of the library's performance features for user-defined distance functions.
Audit Metadata