statsmodels
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data (such as DataFrames, arrays, and time series) for statistical calculations and model fitting.
- Ingestion points: External data enters the agent context via variables like
X_data,y,df, andy_seriespassed to statsmodels fitting functions in the provided code snippets (SKILL.md). - Boundary markers: The skill does not provide specific instructions or delimiters to the agent to treat data content as strictly non-instructional, leaving a surface for data-borne prompt injection.
- Capability inventory: The provided code is restricted to standard data science and visualization libraries (statsmodels, pandas, numpy, scikit-learn, matplotlib) and does not contain dangerous operations such as arbitrary shell execution, network exfiltration of local files, or unauthorized file system writes.
- Sanitization: No input validation or sanitization logic is presented to filter or escape potential instructions embedded within the ingested datasets.
Audit Metadata