d3js-visualization
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the D3.js library from the official d3js.org CDN (https://d3js.org/d3.v7.min.js), which is a trusted and well-known service.
- [COMMAND_EXECUTION]: Documentation includes standard package management commands for developer environment setup, such as npm install d3.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data via helper functions, creating a surface for indirect prompt injection. Ingestion points: scripts/data-helpers.js (parseCSV function) and SKILL.md (d3.csv and d3.json loading patterns). Boundary markers: The skill does not implement specific delimiters for processed data content. Capability inventory: The skill performs network reads of data files and manipulates the Document Object Model (DOM) to render graphics. Sanitization: While numeric type casting is performed during data parsing, there is no semantic sanitization of string content before rendering.
- [METADATA_POISONING]: The inclusion of a skill-report.json file containing self-referential safety claims was evaluated as data rather than a conclusion, following the global security rules. The file appears to be documentation and does not contain malicious instructions.
Audit Metadata