infographic-creator
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch the AntV Infographic library from unpkg.com, a well-known public CDN for JavaScript packages. This is used to render the visual components in the generated HTML output.
- [COMMAND_EXECUTION]: The skill directs the agent to utilize a file-writing tool to save the resulting HTML content to the local filesystem. This is a primary function of the skill to provide the user with a viewable file.
- [DATA_EXPOSURE]: The skill processes user-provided content to populate the infographic. It does not access sensitive local files, environment variables, or credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user content and interpolates it into a generated HTML file, which creates a surface for indirect prompt injection.
- Ingestion points: User-provided text descriptions used to populate the infographic templates.
- Boundary markers: None; the skill does not define specific delimiters or instructions to ignore embedded commands within the input text.
- Capability inventory: The skill uses a file-writing tool to create local HTML files.
- Sanitization: None; the instructions do not explicitly require the agent to escape or sanitize the user-provided strings before placing them into the HTML script block.
Audit Metadata