data-viz-2025
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The documentation file
references/data-storytelling.mdcontains a code example (generateInsight) that demonstrates interpolating raw data into an AI prompt for dynamic analysis. - Ingestion points: The function accepts an array of
DataPointobjects, which are directly converted to JSON and appended to a prompt string. - Boundary markers: The example lacks explicit boundary markers or instructions to the model to ignore potential injection attempts within the data values.
- Capability inventory: The example uses the
fetchAPI to send the resulting prompt to a local endpoint (/api/claude). - Sanitization: No input validation or escaping is applied to the data before it is sent to the language model.
Audit Metadata