data-visualization
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill provides recipes that use the
beltCLI to execute Python code (matplotlib,numpy) and HTML/CSS to generate images. This is the core functionality for automated data visualization and is used for chart generation. - [EXTERNAL_DOWNLOADS]: The documentation references installation instructions for the platform's CLI (
belt) and suggests adding related utility skills via thenpx skills addcommand. These references point to the infrastructure provider's GitHub organization (inference-shandbelt-sh). - [INDIRECT_PROMPT_INJECTION]: The skill provides templates for generating charts from data. When agents use these templates with user-supplied data, there is a potential surface for indirect injection if the data is not sanitized before being embedded in the Python execution strings.
- Ingestion points: Processes user-provided datasets for chart generation (SKILL.md recipes).
- Boundary markers: No explicit delimiters or instructions to ignore embedded instructions are included in the code recipes.
- Capability inventory: Executes Python code via
infsh/python-executorand HTML viainfsh/html-to-imageusing thebeltCLI tool. - Sanitization: No sanitization of input data is suggested before interpolation into script templates.
Audit Metadata