xarray
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external NetCDF and Zarr files which represents a theoretical attack surface for indirect prompt injection via malicious file metadata. However, the risk is minimal as the processing is primarily numerical or statistical and involves no execution of embedded instructions. Ingestion points: scripts/climate_analysis.py (via xr.open_dataset). Boundary markers: Absent. Capability inventory: File system writes (to_netcdf), directory creation (mkdir). Sanitization: Not applicable to binary scientific data formats.
- [EXTERNAL_DOWNLOADS]: The skill utilizes standard, well-known scientific Python libraries such as xarray, numpy, pandas, and netcdf4. These are established packages in the data science ecosystem and are considered safe dependencies.
Audit Metadata