forecasting-reverso
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches model checkpoints from Hugging Face, an established and well-known service for machine learning models.
- [COMMAND_EXECUTION]: The setup process involves installing the
numbapackage usinguv pipwith the--systemand--break-system-packagesflags. This is a common requirement in ephemeral container environments to ensure optimized computation libraries are available. - [DYNAMIC_EXECUTION]:
- The skill uses Numba's
njit(Just-In-Time compilation) to compile Python and NumPy code into machine-executable instructions at runtime for performance. - A custom unpickler implementation in
load_checkpoint.pyis used to load PyTorch checkpoints (.pth files). This implementation follows security best practices by overridingfind_classto strictly whitelist only the necessary tensor and collection types, significantly reducing the risks associated with loading serialized Python objects. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill ingests user-provided time series data via CSV files, lists, or direct input.
- Boundary markers: Explicit boundary markers for numerical data are not used, as the input is treated as numerical tokens rather than natural language instructions.
- Capability inventory: The skill has the capability to write files (saving forecast plots as PNG) and install packages via the system shell.
- Sanitization: The skill effectively sanitizes input by strictly casting user data to 1-D float arrays using
np.asarray(series, dtype=np.float32). Any non-numerical or malicious injection attempts within the time series data would be rejected or rendered inert by this numerical conversion before reaching the model or visualization logic.
Audit Metadata