scientific-toolkit-skill
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads pretrained model weights from Google's official HuggingFace repository for time-series forecasting. It also queries numerous well-known academic APIs for metadata and full texts, including CrossRef, PubMed, arXiv, OpenAlex, Semantic Scholar, and CORE.
- [COMMAND_EXECUTION]: Utility scripts execute external commands via subprocess for research tasks: generate_pdf.py uses pandoc to convert reports; check_system.py uses sysctl and vm_stat to verify system RAM before loading large machine learning models; and the MATLAB skill documentation describes running Octave scripts via terminal commands.
- [DYNAMIC_EXECUTION]: The check_system.py script uses importlib.import_module to verify if required packages like timesfm and torch are installed before attempting to load models.
- [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface for analyzing external scientific data files (CSV, PDF, Excel, HDF5). Ingestion points include eda_analyzer.py, forecast_csv.py, and various PDF and spreadsheet processing scripts. While the documentation provides safety rules, the parsing relies on standard library implementations (pandas, pypdf) without additional NL-specific delimiters.
Audit Metadata