d3-viz
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill's visualization templates, particularly the tooltip example in SKILL.md, utilize the D3 .html() method to render data points like d.label and d.value. This creates an indirect prompt injection surface where malicious scripts hidden in input data could be executed.
- Ingestion points: Data objects passed to functions such as drawChart and drawBarChart in SKILL.md and references/d3-patterns.md.
- Boundary markers: None; there are no instructions for the agent to validate or sanitize the input data.
- Capability inventory: The skill enables extensive DOM manipulation and HTML injection through D3.js.
- Sanitization: No sanitization or escaping mechanisms are included in the code snippets.
- [EXTERNAL_DOWNLOADS]: The skill references the official D3.js CDN at https://d3js.org/d3.v7.min.js. This is a standard reference to a well-known service and is considered safe practice.
Audit Metadata