timesfm
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the official
timesfmpackage from the standard Python registry.- [EXTERNAL_DOWNLOADS]: It fetches model weights and configuration files from Google Research's verified HuggingFace repository (google/timesfm-2.0-200m-pytorch).- [INDIRECT_PROMPT_INJECTION]: The skill identifies ingestion points for external data viaload_csvandget_metricsinSKILL.md. While no explicit boundary markers are defined, the input is processed as numerical NumPy arrays for zero-shot forecasting rather than natural language instructions, minimizing injection risk. The skill's capabilities are limited to standard package installation and local model inference, and input data is sanitized by conversion to numerical formats.
Audit Metadata