magic-data-transformation
Warn
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/derive_columns.pyuses the Pythoneval()function to process calculated column expressions. While it attempts to implement a 'safe' namespace and blocks certain keywords like 'import' and 'exec',eval()can often be bypassed via Python introspection to achieve arbitrary code execution. - [SAFE]: The skill implements mandatory 'PAUSE gates' for all database writes in
scripts/deliver_to_db.pyand HuggingFace Hub uploads inscripts/deliver_to_hf.py, ensuring human-in-the-loop confirmation for sensitive operations. - [SAFE]: The HuggingFace delivery script includes a built-in credential scanner that checks files for common secret patterns (e.g., HF tokens, AWS keys) before they are uploaded to the Hub.
Audit Metadata