umap-learn
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install standard scientific Python libraries (
umap-learn,hdbscan,tensorflow) from public registries usinguv pip. These resources are well-known and standard within the data science ecosystem. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external datasets for manifold approximation and projection, creating an ingestion surface for untrusted data.
- Ingestion points: Data is processed via the
fit(),fit_transform(), andtransform()methods as shown inSKILL.mdand theapi_reference.md. - Boundary markers: The data ingested is expected in structured numerical formats (arrays or sparse matrices); no natural language delimiters or 'ignore' instructions are required for this data type.
- Capability inventory: The skill performs numerical computations, model persistence (via Keras/Pickle), and visualization (Matplotlib). It does not include network exfiltration or shell execution capabilities in its processing path.
- Sanitization: Input is validated through
ensure_all_finitechecks mentioned in the API documentation, ensuring data integrity before processing. - [DYNAMIC_EXECUTION]: The skill documentation describes the use of Numba for Just-In-Time (JIT) compilation of custom distance metrics. This is a standard performance feature of the UMAP library and is used for optimizing mathematical functions, not for executing arbitrary code from untrusted strings.
- [SAFE]: The skill includes a 'Common Issues' section that proactively warns users against naming local files with package names (e.g.,
umap.py), which is a security best practice to prevent local module shadowing and potential hijack attacks.
Audit Metadata