jinko-calibration-cmaes
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes vendor-specific CLI tools (e.g.,
jinko.cli.create_cmaes_calibration,jinko.cli.run_calibration) to perform calibration tasks. These commands are executed as subprocesses using Python's module execution syntax (python -m). - [INDIRECT_PROMPT_INJECTION]: The skill acts as a processing surface for external data (data tables) and user-defined parameters (priors, bounds) which are interpolated into SDK calls.
- Ingestion points: User-provided model IDs (
cm-...), data table IDs (dt-...), and calibration parameter configurations inSKILL.mdandreferences/creating-a-calibration.md. - Boundary markers: None identified in the instruction set to delimit untrusted input or warn against embedded instructions.
- Capability inventory: The skill performs file system operations (writing results via
inspect_calibration --output-dir) and network operations (Jinko API calls through thejinko-sdk) across its scripts. - Sanitization: The instructions do not specify input validation or sanitization routines for the data tables or parameter values before they are passed to the SDK.
Audit Metadata