data-visualization

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill provides recipes that use the belt CLI to execute Python code (matplotlib, numpy) and HTML/CSS to generate images. This is the core functionality for automated data visualization and is used for chart generation.
  • [EXTERNAL_DOWNLOADS]: The documentation references installation instructions for the platform's CLI (belt) and suggests adding related utility skills via the npx skills add command. These references point to the infrastructure provider's GitHub organization (inference-sh and belt-sh).
  • [INDIRECT_PROMPT_INJECTION]: The skill provides templates for generating charts from data. When agents use these templates with user-supplied data, there is a potential surface for indirect injection if the data is not sanitized before being embedded in the Python execution strings.
  • Ingestion points: Processes user-provided datasets for chart generation (SKILL.md recipes).
  • Boundary markers: No explicit delimiters or instructions to ignore embedded instructions are included in the code recipes.
  • Capability inventory: Executes Python code via infsh/python-executor and HTML via infsh/html-to-image using the belt CLI tool.
  • Sanitization: No sanitization of input data is suggested before interpolation into script templates.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 05:53 PM
Security Audit — agent-trust-hub — data-visualization