ltv-prediction
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads 'numpy' and 'scipy' from the Tsinghua University PyPI mirror (a well-known academic mirror) to support its mathematical fitting operations.
- [COMMAND_EXECUTION]: The skill executes the 'ae-cli' tool to retrieve project data and uses 'python3' to execute local analytical scripts.
- [DYNAMIC_EXECUTION]: The skill performs runtime execution of a local Python script ('scripts/fit_ltv.py') to perform curve fitting and references the use of 'RandomForestRegressor' for ML-based predictions.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided data and external database records, which presents an attack surface for indirect instructions.
- Ingestion points: User-pasted retention series and 'ae-cli' report data.
- Boundary markers: The skill explicitly requires a multi-step confirmation of data shape and prediction targets before processing.
- Capability inventory: Includes command execution, file writing for environment setup, and network queries via 'ae-cli'.
- Sanitization: The analysis script ('scripts/fit_ltv.py') includes a 'parse_points' function that strictly validates that all input data points are finite, unique, and non-negative numbers.
Audit Metadata