metrics-chart
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/metrics_chart.pyoptionally executes the systemgnuplotbinary to render PNG, SVG, or Sixel images. This execution is implemented securely usingsubprocess.runwith a list of arguments, avoiding the shell. User-influenced strings such as titles and labels are properly escaped usingjson.dumpsbefore being passed to the gnuplot script, preventing command injection into the gnuplot process. - [SAFE]: The skill operates locally with no network operations detected. It reads metrics data from standard input or local files and writes generated images to temporary files or user-specified paths. All operations are consistent with the skill's stated purpose of data visualization.
- [SAFE]: The code uses only the Python standard library and does not include or download any third-party dependencies. It is authored by axiomhq and uses legitimate vendor patterns for its documentation and scripts.
Audit Metadata