simpy
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation in SKILL.md provides instructions for installing simpy==4.1.2 using uv from the Python Package Index (PyPI), a well-known and trusted package registry for Python software.
- [DYNAMIC_EXECUTION]: The ResourceMonitor class in scripts/resource_monitor.py implements dynamic method patching (monkey-patching) on SimPy Resource instances to intercept request, release, put, and get operations. While this is a common pattern for instrumentation in the SimPy ecosystem, it constitutes a dynamic execution technique used to collect simulation state samples for performance analysis.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied JSON configuration files, creating a potential surface for indirect prompt injection.
- Ingestion points: External configuration files are loaded in scripts/validate_simulation_config.py, scripts/replication_runner.py, scripts/bounded_queue_scenario.py, and scripts/basic_simulation_template.py via the load_json_object utility.
- Boundary markers: The skill uses strict JSON parsing (rejecting non-standard constants), enforces a fixed key allowlist through validate_keys, and applies explicit numeric bounds using integer and finite_number helpers.
- Capability inventory: The skill has capabilities to write local files (via atomic_write_bytes in scripts/_common.py), execute SimPy simulations, and run CLI tools for trace summarization and statistical analysis.
- Sanitization: Input sanitization is performed by strict schema validation, type checking, and range enforcement for all ingested configuration parameters.
Audit Metadata