marimo-notebook
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script 'scripts/convert_notebook.py' executes the 'marimo' command-line interface to perform notebook format conversions using a list-based command structure that prevents shell injection. Additionally, 'references/advanced.md' documents SQL integration via 'mo.sql' for querying local and external data sources.
- [DYNAMIC_EXECUTION]: The skill documents the use of 'mo.iframe' for embedding interactive HTML content and 'mo.lazy' for managing the execution of computationally expensive components, which are standard reactive notebook features.
- [INDIRECT_PROMPT_INJECTION]: The skill documents capabilities for ingesting untrusted data through various input mechanisms. 1. Ingestion points: File uploads in 'assets/data_analysis_template.py' and CLI/URL parameters in 'references/advanced.md'. 2. Boundary markers: Not explicitly defined in the provided templates. 3. Capability inventory: Data querying via 'mo.sql' and notebook management via the 'marimo' CLI. 4. Sanitization: Standard tool-level data handling is used without specific adversarial filtering.
- [EXTERNAL_DOWNLOADS]: The notebook conversion utility 'scripts/convert_notebook.py' allows the 'marimo' CLI to fetch and process notebook files from GitHub URLs.
Audit Metadata