experiment-workspace
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The SKILL.md file provides instructions for installing necessary Python libraries (numpy, scipy) and executing the provided analysis scripts using python or npx tsx. these are standard operational procedures.
- [DATA_EXFILTRATION]: The db-client.ts and db_client.py scripts utilize network requests to synchronize experiment data with an API endpoint defined by the SYNC_API_URL environment variable. This is a documented core feature for experiment state management and defaults to localhost.
- [EXTERNAL_DOWNLOADS]: The data-source-guide.md file instructs users on how to fetch data from external endpoints such as the FeatBit API or custom metrics services. These operations are user-initiated and configured via environment variables.
- [SAFE]: The skill architecture is transparent and does not employ obfuscation or persistence mechanisms. It includes an analysis of the indirect prompt injection surface related to experiment metadata. 1. Ingestion points: Experiment records are fetched from the API in the db-client scripts. 2. Boundary markers: Data is handled as structured JSON without specific natural language delimiters for string fields. 3. Capability inventory: The skill facilitates statistical analysis and database updates via the HTTP API. 4. Sanitization: The skill relies on structured JSON parsing for data handling.
Audit Metadata