revenue-forecast-model-cli
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources (ThinkingEngine platform) via ae-cli query results.
- Ingestion points: The agent is instructed to query DAU, DNU, and revenue trends in Phase 1, which are then passed to the
forecast.pyscript for parameter extraction. - Boundary markers: No explicit delimiters are used in the prompt instructions to isolate external data from the system prompt.
- Capability inventory: The skill performs subprocess execution (
forecast.py,setup.sh) and file system writes (creating.venvand installing packages). - Sanitization: Data is parsed as structured JSON within
forecast.pyusing standardjson.loads(), providing a layer of validation against arbitrary text injection during the modeling phase. - [EXTERNAL_DOWNLOADS]: The
scripts/setup.shscript downloads standard Python libraries (numpy,scipy) from the official PyPI registry or the well-known Tsinghua University academic mirror. These dependencies are reputable, versioned, and necessary for the skill's mathematical modeling functionality. - [COMMAND_EXECUTION]: The skill executes local Python and Bash scripts to perform calculations and manage the environment. These executions are scoped to the skill's directory and implement the primary forecasting logic requested by the user.
Audit Metadata