scikit-survival

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/validate_survival_csv.py uses __import__("numpy") to calculate the median value of time columns. This is a localized dynamic import of a standard scientific dependency and does not process external code.\n- [EXTERNAL_DOWNLOADS]: SKILL.md instructs the agent to fetch citation metadata from ArXiv (arxiv.org), which is a well-known and trusted service for scientific preprints.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted data via CSV ingestion in its validation and training scripts.\n
  • Ingestion points: External CSV files provided via command-line arguments to scripts/validate_survival_csv.py and scripts/train_survival_model.py.\n
  • Boundary markers: The scripts use explicit CLI flags to define the schema and validate that ingested data adheres to expected survival outcome formats (boolean events and numeric times).\n
  • Capability inventory: The skill is capable of writing local files in several formats (.npy, .npz, .json, and .md) and executing scientific Python workflows.\n
  • Sanitization: Centralized validation logic in scripts/_common.py enforces strict limits, including a maximum of 20,000 rows and 32MB file size. It explicitly blocks the use of network URLs or symbolic links as input or output paths, preventing common file-path based attacks.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 12:03 AM
Security Audit — agent-trust-hub — scikit-survival