timesfm-forecasting

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run in scripts/check_system.py to query system resource information (such as sysctl and vm_stat) on Linux and macOS. These operations are restricted to obtaining memory and system statistics with hardcoded arguments.
  • [DYNAMIC_EXECUTION]: The script scripts/check_system.py utilizes importlib.import_module to verify the presence of required Python packages and ctypes to query hardware information on Windows. These are standard implementation patterns for environment validation.
  • [EXTERNAL_DOWNLOADS]: The skill fetches configuration and model weights from official repositories belonging to a well-known organization (Google) on the Hugging Face Hub. Additionally, examples/global-temperature/generate_html.py loads the Chart.js library from a public CDN (JSDelivr).
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external CSV data but enforces strict numeric type conversion (using pd.to_numeric and np.float32) in its data preparation pipeline, which mitigates the risk of malicious data being processed as text.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 10:59 PM