math-identity-check
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The module
_shared/eml_core/viz.pyincludes asubprocess.runcall to thedotutility (Graphviz) for tree visualization. The implementation uses a secure list-based argument format and pipes data through standard input, which effectively prevents shell injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The skill's documentation and source code contain references to external resources, including academic papers on arXiv and project documentation on GitHub Pages. These references are appropriate for the skill's mathematical purpose and target trusted domains.
- [PROMPT_INJECTION]: The skill ingests user-provided mathematical expressions through the
--lhsand--rhsarguments inscripts/check.py. While this constitutes an indirect prompt injection surface, the skill mitigates potential risks by utilizing a restrictedlocal_dictduring Sympy parsing, which limits the execution environment to a specific set of mathematical primitives.
Audit Metadata