timesfm-forecasting
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill features the ability to ingest external CSV files for time series forecasting.
- Ingestion points: Data ingestion occurs through
pandas.read_csv()inscripts/forecast_csv.pyand example scripts likeexamples/anomaly-detection/detect_anomalies.py. - Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are implemented for the data fields, representing a standard injection surface for skills processing external files.
- Capability inventory: The skill possesses capabilities for system resource discovery and network downloads for model assets, which are handled through static, non-user-controllable parameters.
- Sanitization: Input values are primarily handled as numeric types, and no unsafe interpolation of string content from files was observed.
- [EXTERNAL_DOWNLOADS]: The skill retrieves machine learning model weights from Hugging Face Hub under the
googleorganization (e.g.,google/timesfm-2.5-200m-pytorch). These assets are hosted on a well-known service and are necessary for the skill's primary functionality. - [COMMAND_EXECUTION]: The preflight utility
scripts/check_system.pyexecutes system commands includingsysctlandvm_staton macOS to monitor hardware resources. These operations are limited to gathering information about physical RAM and VRAM to ensure the environment can support the model's memory requirements. - [DYNAMIC_EXECUTION]: The
scripts/check_system.pyscript uses the__import__()function to programmatically verify that required dependencies liketorchandtimesfmare correctly installed in the Python environment.
Audit Metadata