umap-learn

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the umap-learn package and its optional dependencies (such as TensorFlow for Parametric UMAP) using standard Python package managers. These are well-known, legitimate libraries in the data science ecosystem.
  • [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection as it is designed to ingest and process external datasets for dimensionality reduction and clustering.
  • Ingestion points: Data arrays passed to the fit, fit_transform, and transform methods across all examples in SKILL.md and references/api_reference.md.
  • Boundary markers: Absent; the skill expects pre-loaded numerical data without specific markers to distinguish between data and potential instructions.
  • Capability inventory: Includes local file creation for visualizations (plt.savefig in SKILL.md) and package installation instructions (pip install in SKILL.md).
  • Sanitization: Absent; while standard scaling (StandardScaler) is used, it is intended for feature normalization rather than security-based sanitization of input data.
  • [DYNAMIC_EXECUTION]: The skill demonstrates the use of Numba-compiled custom distance metrics. Numba performs Just-In-Time (JIT) compilation of Python code into machine code to optimize performance. In the provided context, this is a standard application of the library's performance features for user-defined distance functions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 12:54 AM