mmm-meridian

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [SAFE]: The skill serves as a reference for Google Meridian v1.8.0, providing legitimate code snippets for Bayesian modeling and optimization tasks.
  • [EXTERNAL_DOWNLOADS]: The skill describes the installation process for the google-meridian library and its dependencies, including tensorflow and tfp-nightly, using standard package managers. These resources originate from a well-known technology company.
  • [INDIRECT_PROMPT_INJECTION]: The skill documents methods for loading external datasets (e.g., CSV, DataFrames) and exporting results to local files, which creates a potential surface for indirect prompt injection if the processed data contains malicious instructions.
  • Ingestion points: DataFrameDataLoader, CsvDataLoader, and XrDatasetDataLoader are used to load external business data in SKILL.md.
  • Boundary markers: The instructions do not specify the use of delimiters or safety warnings for the imported data.
  • Capability inventory: The skill utilizes file-writing capabilities through model.save_mmm, output_optimization_summary, and output_model_results_summary as seen in SKILL.md.
  • Sanitization: The skill relies on standard library loaders and does not prescribe explicit sanitization or validation logic for the input content.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 01:07 PM