deep-sky-advisor
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs legitimate image analysis for astrophotography. It calculates astronomical metrics like FWHM, background noise, and clipping using standard scientific libraries. It focuses on evidence-based advice without modifying image data.
- [EXTERNAL_DOWNLOADS]: The skill includes a shell script (
run_analysis.sh) that sets up a Python virtual environment and installs dependencies fromrequirements.txt. The packages listed (astropy,numpy,scipy,Pillow,tifffile,xisf) are well-known, official scientific libraries. The skill instructions explicitly state that user approval should be obtained before performing network operations or package installations. - [COMMAND_EXECUTION]: The skill uses a launcher script to execute its Python analysis logic. The scripts use standard argument parsing and do not expose the system to arbitrary command injection from untrusted metadata fields.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests metadata from image files (FITS headers) for classification and diagnostics. The evidence chain shows safe handling: 1. Ingestion points: Image files (FITS headers) processed in
scripts/analyze_file.py. 2. Boundary markers: Output is provided as structured Markdown and JSON reports. 3. Capability inventory: Local file writing and script execution limited to analysis tools. 4. Sanitization: Metadata is processed as string data for heuristic matching and reporting, with no unsafe interpolation into code execution paths.
Audit Metadata