pycse
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the pycse package from PyPI, which is the core library for the skill scientific functionality. This is a vendor-owned resource matching the skill author.
- [INDIRECT_PROMPT_INJECTION]: The skill provides the read_gsheet utility which fetches data from Google Sheets URLs. This creates a surface where untrusted content could be ingested into the agent context.
- Ingestion points: Content is fetched from Google Sheets URLs and converted into pandas DataFrames in SKILL.md.
- Boundary markers: No specific boundary markers or instructions to ignore embedded content are provided in the examples.
- Capability inventory: The skill enables regression analysis and file system operations via the caching mechanism.
- Sanitization: There is no evidence of input validation or content filtering for the ingested data.
- [DYNAMIC_EXECUTION]: The HashCache mechanism uses Pythons pickle module for persistent storage. This presents a risk of unsafe deserialization if the underlying cache files are tampered with or replaced with malicious data.
Audit Metadata