sample-group-sankey-plot
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs required R dependencies (optparse, ggplot2, ggalluvial, and testthat) from the official Comprehensive R Archive Network (CRAN) at https://cloud.r-project.org.
- [COMMAND_EXECUTION]: The skill invokes R scripts (main.R and install_dependencies.R) to process datasets and generate visualizations, which is consistent with its stated analytical purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied categorical tables (CSV/TSV), which serves as a data ingestion point.
- Ingestion points: Data is read through read_annotation_table in scripts/utils.R.
- Boundary markers: No specific boundary markers are utilized for the data ingestion stage.
- Capability inventory: The skill possesses capabilities to create directories and write files (CSV and PDF) to the local filesystem via scripts/functions.R.
- Sanitization: The skill implements validate_output_prefix in scripts/utils.R, which restricts filenames to a safe character set (alphanumeric, dots, underscores, hyphens) to mitigate potential path traversal vulnerabilities.
Audit Metadata