Skills
skills/liangdabiao/claude-data-analysis-ultra/growth-model-analyzer/Gen Agent Trust Hub

growth-model-analyzer

Warn

Audited by Gen Agent Trust Hub on Mar 12, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The UpliftModeler.load_model method in scripts/uplift_modeling.py uses joblib.load(). This function is known to be unsafe for loading data from untrusted sources as it can lead to arbitrary code execution through malicious pickle data.
  • [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. Ingestion points: Data enters via GrowthModelAnalyzer.load_data in scripts/growth_analyzer.py which reads CSV and Excel files. Boundary markers: No delimiters or 'ignore' instructions are used during data interpolation. Capability inventory: The skill includes file reading and writing capabilities and unsafe deserialization via joblib.load. Sanitization: There is no evidence of input validation or escaping for the ingested data.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 12, 2026, 05:33 AM