qiskit

Pass

Audited by Gen Agent Trust Hub on Oct 24, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: No malicious patterns or security vulnerabilities were detected in the skill instructions or associated scripts.
  • [DYNAMIC_EXECUTION]: The script scripts/check_environment.py utilizes importlib.import_module to verify that required quantum computing packages are correctly installed in the environment. This is a legitimate diagnostic function, and the modules are imported from a hardcoded list of verified package names.
  • [CREDENTIALS_SAFE]: The skill provides explicit instructions on secure credential management for the IBM Quantum Platform. It directs users to use environment variables (IBM_QUANTUM_API_KEY) and standard configuration files, and it includes clear warnings against hardcoding, printing, or committing API keys to version control.
  • [EXTERNAL_DOWNLOADS]: The skill references and installs standard Qiskit ecosystem packages from the official Python Package Index (PyPI). All installation commands use strict version pinning (e.g., qiskit==2.5.2) to ensure reproducibility and mitigate supply chain risks.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The skill handles quantum circuit serialization via the QPY format and explicitly warns users to treat external binary inputs as untrusted, recommending against the use of the insecure pickle module for circuit data.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 24, 2026, 09:40 PM