math-identity-check

Pass

Audited by Gen Agent Trust Hub on Aug 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The module _shared/eml_core/viz.py includes a subprocess.run call to the dot utility (Graphviz) for tree visualization. The implementation uses a secure list-based argument format and pipes data through standard input, which effectively prevents shell injection vulnerabilities.
  • [EXTERNAL_DOWNLOADS]: The skill's documentation and source code contain references to external resources, including academic papers on arXiv and project documentation on GitHub Pages. These references are appropriate for the skill's mathematical purpose and target trusted domains.
  • [PROMPT_INJECTION]: The skill ingests user-provided mathematical expressions through the --lhs and --rhs arguments in scripts/check.py. While this constitutes an indirect prompt injection surface, the skill mitigates potential risks by utilizing a restricted local_dict during Sympy parsing, which limits the execution environment to a specific set of mathematical primitives.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 23, 2026, 05:32 PM
Security Audit — agent-trust-hub — math-identity-check