qutip
Warn
Audited by Gen Agent Trust Hub on Feb 15, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [Dynamic Execution] (MEDIUM): The skill documents the use of
Result.load()to restore simulation data from external files. - Evidence: In
references/time_evolution.md, the exampleloaded_result = Result.load("my_simulation.dat")is provided. - Risk: QuTiP's internal storage mechanism for results often relies on Python's
picklemodule. If an agent is induced to load a.datfile provided by an untrusted user or downloaded from an untrusted source, it could lead to Remote Code Execution (RCE). - [External Downloads] (LOW): The skill instructs the agent to install several external packages from PyPI.
- Evidence:
SKILL.mdcontains commands to installqutip,qutip-qip, andqutip-qtrlusinguv pip. - Note: These are legitimate and widely-used scientific libraries, but they constitute external dependencies that must be fetched at runtime.
- [Dynamic Execution] (LOW): The skill supports string-based time-dependent Hamiltonians that require runtime compilation via Cython.
- Evidence: Found in
references/time_evolution.md:H = [num(N), [destroy(N) + create(N), 'cos(w*t)']]. The documentation notes this method 'requires Cython'. - Risk: While standard for scientific computing, this involves runtime code generation and compilation of user-provided strings.
Audit Metadata