sympy
Warn
Audited by Gen Agent Trust Hub on Mar 31, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the use of
lambdify,autowrap, andufuncifyinreferences/code-generation-printing.md. These functions generate Python, C, or Fortran code from symbolic expressions, compile it at runtime, and load the resulting executable into the environment, which is a form of dynamic code execution. - [COMMAND_EXECUTION]: In
references/code-generation-printing.md, instructions describe functions likeparse_expr,parse_latex, andparse_mathematica. These utilities convert strings into SymPy objects using internal evaluation logic that can be exploited for arbitrary code execution if the input strings are not strictly sanitized. - [COMMAND_EXECUTION]: The
references/code-generation-printing.mdfile provides an example of object persistence usingpickle.load(). Unsafe deserialization of pickle data is a known vulnerability that can allow an attacker to execute arbitrary code within the host environment.
Audit Metadata