meta-radial-plot

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user-supplied CSV files which are then processed by R and Python scripts. \n
  • Ingestion points: read.csv in scripts/radial_plot.R and pd.read_csv in scripts/radial_plot_backup.py. \n
  • Boundary markers: Absent. There are no specific delimiters or instructions to ignore potential injection content within the CSV data labels. \n
  • Capability inventory: The skill can write files to the filesystem (ggsave, write.csv, savefig, to_csv) and executes subprocesses via Rscript and python. \n
  • Sanitization: The scripts perform type validation by converting values to numeric types (e.g., as.numeric), which effectively sanitizes the data used for calculations, though string fields like study names remain unsanitized. \n- [COMMAND_EXECUTION]: The skill executes local R and Python scripts which is consistent with its stated purpose. \n
  • Evidence: Workflow instructions in SKILL.md call Rscript scripts/radial_plot.R and python scripts/radial_plot_backup.py. \n- [DYNAMIC_EXECUTION]: The skill instructions include a step to compile the Python script before execution. \n
  • Evidence: python -m py_compile scripts/radial_plot_backup.py in SKILL.md. \n- [EXTERNAL_DOWNLOADS]: The skill documentation lists several R package dependencies. \n
  • R packages: meta, metafor, ggplot2, ggrepel.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 04:47 PM