plotly

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill documentation includes instructions to install standard Python libraries such as plotly, pandas, kaleido, and dash.
  • Evidence: uv pip install "plotly>=5.0" "pandas>=1.5" "kaleido>=0.2" in SKILL.md.
  • Evaluation: These are well-known, legitimate packages from official registries or the vendor's own repository (github.com/aipoch/medical-research-skills), representing standard setup for visualization tasks.
  • [COMMAND_EXECUTION]: The skill provides Python code examples for data processing and chart generation.
  • Evidence: Multiple code blocks in SKILL.md and references/ demonstrating the use of plotly.express and plotly.graph_objects.
  • Evaluation: The execution is limited to standard plotting functionality and does not involve risky system calls or unauthorized operations.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process data sets provided by users or external sources to generate interactive visualizations, which creates an inherent ingestion surface.
  • Ingestion points: DataFrames and data arrays ingested via plotly chart functions (e.g., px.scatter, go.Bar) as described in SKILL.md and references/chart-types.md.
  • Boundary markers: The skill includes explicit instructions to validate required inputs before execution and to confirm source files, scope limits, and acceptance criteria.
  • Capability inventory: Python code execution for data manipulation (pandas) and visualization rendering (plotly).
  • Sanitization: The skill emphasizes standard library use and instructs the agent to stop early if mandatory fields or files are missing, relying on the visualization engine for secure rendering.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 04:48 PM