meta-radial-plot
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user-supplied CSV files which are then processed by R and Python scripts. \n
- Ingestion points:
read.csvinscripts/radial_plot.Randpd.read_csvinscripts/radial_plot_backup.py. \n - Boundary markers: Absent. There are no specific delimiters or instructions to ignore potential injection content within the CSV data labels. \n
- Capability inventory: The skill can write files to the filesystem (
ggsave,write.csv,savefig,to_csv) and executes subprocesses viaRscriptandpython. \n - Sanitization: The scripts perform type validation by converting values to numeric types (e.g.,
as.numeric), which effectively sanitizes the data used for calculations, though string fields like study names remain unsanitized. \n- [COMMAND_EXECUTION]: The skill executes local R and Python scripts which is consistent with its stated purpose. \n - Evidence: Workflow instructions in
SKILL.mdcallRscript scripts/radial_plot.Randpython scripts/radial_plot_backup.py. \n- [DYNAMIC_EXECUTION]: The skill instructions include a step to compile the Python script before execution. \n - Evidence:
python -m py_compile scripts/radial_plot_backup.pyinSKILL.md. \n- [EXTERNAL_DOWNLOADS]: The skill documentation lists several R package dependencies. \n - R packages:
meta,metafor,ggplot2,ggrepel.
Audit Metadata