jinko-task-from-nonmem

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied NONMEM control streams and datasets. This data ingestion surface is protected by a mandatory verification mechanism in publish_equivalence_report.py, which uses SHA-256 digests to ensure that the content reviewed by a human in a dry-run matches the content eventually published to the platform. \n- [COMMAND_EXECUTION]: The verification logic in compare_against_reference.py optionally executes local R scripts to leverage the nonmem2rx and rxode2 packages. These calls are limited to model parsing and numerical simulation, using local installations of these pharmacometric libraries. \n- [DATA_EXPOSURE]: The skill manages sensitive model data by uploading it to the Jinkō platform through the official jinko-sdk. The publish_equivalence_report.py script includes explicit safeguards against path traversal, rejecting absolute paths, symlinks, or parent directory traversal when handling report images.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 03:28 PM