skills/axiomhq/skills/metrics-chart/Gen Agent Trust Hub

metrics-chart

Pass

Audited by Gen Agent Trust Hub on Jul 14, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/metrics_chart.py optionally executes the system gnuplot binary to render PNG, SVG, or Sixel images. This execution is implemented securely using subprocess.run with a list of arguments, avoiding the shell. User-influenced strings such as titles and labels are properly escaped using json.dumps before being passed to the gnuplot script, preventing command injection into the gnuplot process.
  • [SAFE]: The skill operates locally with no network operations detected. It reads metrics data from standard input or local files and writes generated images to temporary files or user-specified paths. All operations are consistent with the skill's stated purpose of data visualization.
  • [SAFE]: The code uses only the Python standard library and does not include or download any third-party dependencies. It is authored by axiomhq and uses legitimate vendor patterns for its documentation and scripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 14, 2026, 10:52 PM
Security Audit — agent-trust-hub — metrics-chart