mmm-meridian
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill serves as a reference for Google Meridian v1.8.0, providing legitimate code snippets for Bayesian modeling and optimization tasks.
- [EXTERNAL_DOWNLOADS]: The skill describes the installation process for the
google-meridianlibrary and its dependencies, includingtensorflowandtfp-nightly, using standard package managers. These resources originate from a well-known technology company. - [INDIRECT_PROMPT_INJECTION]: The skill documents methods for loading external datasets (e.g., CSV, DataFrames) and exporting results to local files, which creates a potential surface for indirect prompt injection if the processed data contains malicious instructions.
- Ingestion points:
DataFrameDataLoader,CsvDataLoader, andXrDatasetDataLoaderare used to load external business data inSKILL.md. - Boundary markers: The instructions do not specify the use of delimiters or safety warnings for the imported data.
- Capability inventory: The skill utilizes file-writing capabilities through
model.save_mmm,output_optimization_summary, andoutput_model_results_summaryas seen inSKILL.md. - Sanitization: The skill relies on standard library loaders and does not prescribe explicit sanitization or validation logic for the input content.
Audit Metadata