pandas-pro
Fail
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSMETADATA_POISONINGINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Automated security scans identified that the documentation URL (https://jeffallan.github.io/claude-skills/skills/data-ml/pandas-pro/) provided in the skill is blacklisted. Furthermore, the SKILL.md file itself has been flagged as malicious by file reputation scanners.
- [METADATA_POISONING]: The skill's metadata attributes the work to 'Jeffallan', which contradicts the source author context 'sodiqabdulwaris'. This discrepancy in attribution indicates a risk of metadata poisoning or unauthorized content mirroring.
- [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data ingestion via functions like 'pd.read_csv' (referenced in data-cleaning.md) and lacks boundary markers or sanitization logic. The agent is directed to use high-capability pandas tools on this data, creating a vector for indirect injection attacks from malicious data payloads.
- [DYNAMIC_EXECUTION]: The performance-optimization.md reference promotes the use of 'pd.eval()' and 'df.query()'. These patterns involve dynamic string evaluation which can be exploited for code injection if untrusted data is processed without sufficient validation.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata