timesfm-forecasting

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill features the ability to ingest external CSV files for time series forecasting.
  • Ingestion points: Data ingestion occurs through pandas.read_csv() in scripts/forecast_csv.py and example scripts like examples/anomaly-detection/detect_anomalies.py.
  • Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are implemented for the data fields, representing a standard injection surface for skills processing external files.
  • Capability inventory: The skill possesses capabilities for system resource discovery and network downloads for model assets, which are handled through static, non-user-controllable parameters.
  • Sanitization: Input values are primarily handled as numeric types, and no unsafe interpolation of string content from files was observed.
  • [EXTERNAL_DOWNLOADS]: The skill retrieves machine learning model weights from Hugging Face Hub under the google organization (e.g., google/timesfm-2.5-200m-pytorch). These assets are hosted on a well-known service and are necessary for the skill's primary functionality.
  • [COMMAND_EXECUTION]: The preflight utility scripts/check_system.py executes system commands including sysctl and vm_stat on macOS to monitor hardware resources. These operations are limited to gathering information about physical RAM and VRAM to ensure the environment can support the model's memory requirements.
  • [DYNAMIC_EXECUTION]: The scripts/check_system.py script uses the __import__() function to programmatically verify that required dependencies like torch and timesfm are correctly installed in the Python environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 05:05 PM