pooch
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates downloading scientific datasets from external sources such as URLs, DOIs (Zenodo), and GitHub repositories.
- [DYNAMIC_EXECUTION]: The skill provides functionality to extract and decompress files from archives (ZIP, TAR, GZIP) at runtime using Pooch's built-in processors such as Unzip and Untar.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data which could potentially contain malicious content; however, it mitigates this risk by promoting integrity verification via checksums.
- Ingestion points: Data fetching via pooch.retrieve and REGISTRY.fetch calls found in SKILL.md and references/registry.md.
- Boundary markers: Verification of files against provided known_hash values.
- Capability inventory: Network fetch operations and file extraction from archives.
- Sanitization: Validation of file hashes using SHA256 or MD5 algorithms before processing.
Audit Metadata