antv-infographic
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill generates HTML files that fetch the AntV Infographic library from the unpkg CDN. This is a legitimate vendor-owned resource required for the infographic rendering functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user requirements to populate data fields (title, desc, labels) within the infographic DSL and subsequently the generated HTML file. There is a potential risk that malicious user input could attempt to break out of the data structure to inject scripts or malicious content into the final file.
- Ingestion points: User requirements processed in Step 1 of the generation process.
- Boundary markers: None explicitly defined in the instructions to delimit user content from the rendering logic.
- Capability inventory: The skill uses a Write tool to save files to the local file system.
- Sanitization: The instructions do not specify sanitization or escaping protocols for user-supplied strings before they are interpolated into the HTML template.
- [DYNAMIC_EXECUTION]: The skill generates an HTML file containing a JavaScript block that initializes the AntVInfographic object and executes a render command at runtime based on the generated DSL syntax.
Audit Metadata