charts
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a local script
pnpm action generate-chartto process data and render charts into PNG images for embedding in chat. - [EXTERNAL_DOWNLOADS]: The skill references
quickchart.io, a well-known service for generating charts via URL templates, which is a standard integration for visualization skills. - [PROMPT_INJECTION]: The skill ingests untrusted data through parameters like
--labelsand--data, which constitutes a surface for indirect prompt injection. 1. Ingestion points: Arguments passed to thegenerate-chartscript inSKILL.md. 2. Boundary markers: None provided. 3. Capability inventory: Execution of a local command (pnpm action). 4. Sanitization: No specific sanitization or validation logic is mentioned for the input parameters.
Audit Metadata