plotly
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation includes instructions to install standard Python libraries such as plotly, pandas, kaleido, and dash.
- Evidence: uv pip install "plotly>=5.0" "pandas>=1.5" "kaleido>=0.2" in SKILL.md.
- Evaluation: These are well-known, legitimate packages from official registries or the vendor's own repository (github.com/aipoch/medical-research-skills), representing standard setup for visualization tasks.
- [COMMAND_EXECUTION]: The skill provides Python code examples for data processing and chart generation.
- Evidence: Multiple code blocks in SKILL.md and references/ demonstrating the use of plotly.express and plotly.graph_objects.
- Evaluation: The execution is limited to standard plotting functionality and does not involve risky system calls or unauthorized operations.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process data sets provided by users or external sources to generate interactive visualizations, which creates an inherent ingestion surface.
- Ingestion points: DataFrames and data arrays ingested via plotly chart functions (e.g., px.scatter, go.Bar) as described in SKILL.md and references/chart-types.md.
- Boundary markers: The skill includes explicit instructions to validate required inputs before execution and to confirm source files, scope limits, and acceptance criteria.
- Capability inventory: Python code execution for data manipulation (pandas) and visualization rendering (plotly).
- Sanitization: The skill emphasizes standard library use and instructs the agent to stop early if mandatory fields or files are missing, relying on the visualization engine for secure rendering.
Audit Metadata