marimo-pair
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the
execute_codetool to run arbitrary Python code in the user's live notebook kernel, enabling tasks like data inspection and code testing. - [COMMAND_EXECUTION]: It uses
marimo._code_mode, a vendor-specific API, to programmatically modify notebook cells and maintain persistence in the user's session. - [COMMAND_EXECUTION]: The documentation provides a specific technique for patching library internals (e.g., Polars) at runtime to address environment-specific caching issues.
- [EXTERNAL_DOWNLOADS]: The skill allows for the installation of Python packages via
ctx.packages.add()and the loading of JavaScript modules from theesm.shCDN for custom widgets. - [PROMPT_INJECTION]: The skill reads existing notebook code from
ctx.cells, which presents a surface for indirect prompt injection if the notebook contains adversarial instructions. - Ingestion points: Notebook cells and metadata are read from
ctx.cellsandctx.graphinSKILL.md. - Boundary markers: No specific delimiters or safety warnings are implemented to isolate user-provided code.
- Capability inventory: The agent can execute arbitrary Python and manipulate notebook structure.
- Sanitization: Content from the notebook is processed directly without validation or sanitization.
Audit Metadata