denario

Warn

Audited by Gen Agent Trust Hub on Mar 31, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The get_results() method generates and executes Python code at runtime to perform data analysis, statistical modeling, and visualization generation based on the methodology developed by the agent system.
  • [REMOTE_CODE_EXECUTION]: The core research workflow depends on an Execution Agent writing and running scripts dynamically. If the planning agents are manipulated, this creates a vector for arbitrary code execution in the host environment.
  • [EXTERNAL_DOWNLOADS]: The documentation provides installation paths for a GitHub repository (AstroPilot-AI/Denario) and a Docker image (pablovd/denario) that originate from maintainers different from the primary author K-Dense Inc. listed in the skill metadata.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface where untrusted data descriptions influence downstream execution.
  • Ingestion points: Untrusted research context enters the system via set_data_description in SKILL.md and references/research_pipeline.md.
  • Boundary markers: No delimiters or safety instructions are used to separate user-provided data descriptions from agent instructions.
  • Capability inventory: The system possesses code execution capabilities (get_results), file system access for project outputs, and network access for literature searches.
  • Sanitization: No validation or sanitization of the input description is performed before it is used for hypothesis and methodology generation.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 31, 2026, 08:22 AM
Security Audit — agent-trust-hub — denario