skills/marimo-team/marimo/marimo-pair/Gen Agent Trust Hub

marimo-pair

Pass

Audited by Gen Agent Trust Hub on Jul 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies on the execute_code tool to run arbitrary Python code in the user's live notebook kernel, enabling tasks like data inspection and code testing.
  • [COMMAND_EXECUTION]: It uses marimo._code_mode, a vendor-specific API, to programmatically modify notebook cells and maintain persistence in the user's session.
  • [COMMAND_EXECUTION]: The documentation provides a specific technique for patching library internals (e.g., Polars) at runtime to address environment-specific caching issues.
  • [EXTERNAL_DOWNLOADS]: The skill allows for the installation of Python packages via ctx.packages.add() and the loading of JavaScript modules from the esm.sh CDN for custom widgets.
  • [PROMPT_INJECTION]: The skill reads existing notebook code from ctx.cells, which presents a surface for indirect prompt injection if the notebook contains adversarial instructions.
  • Ingestion points: Notebook cells and metadata are read from ctx.cells and ctx.graph in SKILL.md.
  • Boundary markers: No specific delimiters or safety warnings are implemented to isolate user-provided code.
  • Capability inventory: The agent can execute arbitrary Python and manipulate notebook structure.
  • Sanitization: Content from the notebook is processed directly without validation or sanitization.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 23, 2026, 08:24 PM
Security Audit — agent-trust-hub — marimo-pair