data-io-loading
Warn
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill documents and promotes the use of
ov.io.saveandov.io.load, which utilizecloudpickleandpicklefor Python object serialization. Loading a maliciously crafted pickle file can result in arbitrary code execution. The documentation explicitly shows this for saving and loading models and lists (ov.io.save(my_model, 'model.pkl'),ov.io.load('model.pkl')). - [PROMPT_INJECTION]: The skill facilitates the ingestion of external data from various untrusted formats (h5ad, CSV, TSV, MTX, Visium, Nanostring) without providing explicit boundary markers or sanitization guidance. This creates a surface for indirect prompt injection where malicious instructions could be embedded in metadata fields or gene names within these files.
- Ingestion points:
ov.read(),ov.io.read_h5ad(),ov.io.read_10x_h5(),ov.io.read_10x_mtx(),ov.io.spatial.read_visium(),ov.io.read_visium_hd(),ov.io.read_nanostring(),ov.io.read_csv(). - Boundary markers: None mentioned in the skill or usage examples.
- Capability inventory: The skill documents data reading, writing (serialization), and potential for script execution via the optional Rust backend (
snapatac2). - Sanitization: No sanitization or validation of the content within the data files is mentioned beyond checking for file existence.
Audit Metadata