jupyter-to-marimo
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- EXTERNAL_DOWNLOADS (SAFE): The skill uses
uvxto download and run themarimopackage from PyPI. While this executes external code,marimois a well-established open-source project and is essential for the skill's functionality. - COMMAND_EXECUTION (SAFE): Commands such as
marimo convertandmarimo checkare executed to perform the conversion. These are standard operations for the described task. - Indirect Prompt Injection (LOW): The skill processes user-supplied Jupyter notebooks which are untrusted data. 1. Ingestion points: User-provided
<notebook.ipynb>files. 2. Boundary markers: None; the agent is instructed to read the file contents directly. 3. Capability inventory: Command execution viauvxand file system read/write access. 4. Sanitization: No sanitization is performed on the input notebook before conversion or processing.
Audit Metadata