tracker-stats-dashboard
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [Command Execution]: The skill executes local Python and Bash scripts, such as setup_preflight and run.sh, to perform project validation and orchestrate dashboard generation. These operations rely on the integrity of the local environment and project scripts.
- [Indirect Prompt Injection]: The skill ingests data from external GitHub repositories, including issue titles and bodies, representing a potential vulnerability surface. (1) Ingestion points: Data enters via fetch_issues.py and other scripts using the GitHub API; (2) Boundary markers: No specific delimiters or instructions to ignore embedded commands were identified; (3) Capability inventory: The skill utilizes subprocess execution for shell and Python tasks; (4) Sanitization: The process does not explicitly detail the sanitization of issue content before rendering into HTML.
- [External Data Fetching]: The skill retrieves metadata from api.github.com and references Plotly's CDN for rendering. While these are well-known services, the processing of this remote data is a key part of the skill's operations and warrants standard security review.
Audit Metadata