qutip

Warn

Audited by Gen Agent Trust Hub on Feb 15, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [Dynamic Execution] (MEDIUM): The skill documents the use of Result.load() to restore simulation data from external files.
  • Evidence: In references/time_evolution.md, the example loaded_result = Result.load("my_simulation.dat") is provided.
  • Risk: QuTiP's internal storage mechanism for results often relies on Python's pickle module. If an agent is induced to load a .dat file provided by an untrusted user or downloaded from an untrusted source, it could lead to Remote Code Execution (RCE).
  • [External Downloads] (LOW): The skill instructs the agent to install several external packages from PyPI.
  • Evidence: SKILL.md contains commands to install qutip, qutip-qip, and qutip-qtrl using uv pip.
  • Note: These are legitimate and widely-used scientific libraries, but they constitute external dependencies that must be fetched at runtime.
  • [Dynamic Execution] (LOW): The skill supports string-based time-dependent Hamiltonians that require runtime compilation via Cython.
  • Evidence: Found in references/time_evolution.md: H = [num(N), [destroy(N) + create(N), 'cos(w*t)']]. The documentation notes this method 'requires Cython'.
  • Risk: While standard for scientific computing, this involves runtime code generation and compilation of user-provided strings.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Feb 15, 2026, 10:13 PM