scikit-survival
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/validate_survival_csv.pyuses__import__("numpy")to calculate the median value of time columns. This is a localized dynamic import of a standard scientific dependency and does not process external code.\n- [EXTERNAL_DOWNLOADS]:SKILL.mdinstructs the agent to fetch citation metadata from ArXiv (arxiv.org), which is a well-known and trusted service for scientific preprints.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted data via CSV ingestion in its validation and training scripts.\n - Ingestion points: External CSV files provided via command-line arguments to
scripts/validate_survival_csv.pyandscripts/train_survival_model.py.\n - Boundary markers: The scripts use explicit CLI flags to define the schema and validate that ingested data adheres to expected survival outcome formats (boolean events and numeric times).\n
- Capability inventory: The skill is capable of writing local files in several formats (
.npy,.npz,.json, and.md) and executing scientific Python workflows.\n - Sanitization: Centralized validation logic in
scripts/_common.pyenforces strict limits, including a maximum of 20,000 rows and 32MB file size. It explicitly blocks the use of network URLs or symbolic links as input or output paths, preventing common file-path based attacks.
Audit Metadata