timesfm-forecasting
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runinscripts/check_system.pyto query system resource information (such assysctlandvm_stat) on Linux and macOS. These operations are restricted to obtaining memory and system statistics with hardcoded arguments. - [DYNAMIC_EXECUTION]: The script
scripts/check_system.pyutilizesimportlib.import_moduleto verify the presence of required Python packages andctypesto query hardware information on Windows. These are standard implementation patterns for environment validation. - [EXTERNAL_DOWNLOADS]: The skill fetches configuration and model weights from official repositories belonging to a well-known organization (Google) on the Hugging Face Hub. Additionally,
examples/global-temperature/generate_html.pyloads the Chart.js library from a public CDN (JSDelivr). - [INDIRECT_PROMPT_INJECTION]: The skill processes external CSV data but enforces strict numeric type conversion (using
pd.to_numericandnp.float32) in its data preparation pipeline, which mitigates the risk of malicious data being processed as text.
Audit Metadata