jinko-vpop

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill depends on the jinko-sdk and pandas Python packages. The jinko-sdk is an official resource from the skill's author (Nova In Silico) and is used for interacting with the Jinkō platform.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data from external files which could potentially contain malicious instructions intended for the agent or the downstream API.
  • Ingestion points: Data is ingested via scripts/create_vpop_from_csv.py (CSV files) and scripts/create_vpop_design_from_design.py / scripts/edit_vpop_design.py (JSON design files).
  • Boundary markers: The skill performs structural validation, such as verifying the patientIndex header in CSVs, checking for duplicate IDs in JSON marginal lists, and validating distribution tags against assets/distrib.json.
  • Capability inventory: The skill can create, update, and generate virtual population items and folders on the Jinkō platform through the SDK. It also provides inspection tools for existing items.
  • Sanitization: The skill relies on standard csv and json Python modules for parsing. It requires an explicit --apply flag or user confirmation before making any write operations to the platform, providing a human-in-the-loop security check.
  • [COMMAND_EXECUTION]: The skill provides several Python scripts for the agent to execute via the shell to perform its tasks. These scripts follow best practices, such as implementing dry-run modes by default to prevent accidental data modification.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 12:26 PM
Security Audit — agent-trust-hub — jinko-vpop