forcegraph-exporter
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The generated HTML file fetches the 'force-graph' library from unpkg.com, which is a well-known and standard content delivery network for web packages. This is a required dependency for the interactive visualization to function.
- [COMMAND_EXECUTION]: The skill uses a Python script (
scripts/generate_forcegraph.py) to process data and write the output file. The commands are standard file operations and do not involve high-risk actions like privilege escalation or persistence. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided or agent-generated JSON data. While this is an ingestion surface for untrusted data, the script includes sanitization (HTML escaping for the title and JSON string replacement to prevent script tag injection) which significantly mitigates the risk of the generated HTML being used for malicious purposes.
Audit Metadata