creating-good-dashboards
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon user-provided comments and @mentions within a dashboard environment. This creates a surface for indirect prompt injection, as malicious instructions could be embedded in comments to influence the agent's behavior during dashboard revisions or comment replies.
- Ingestion points: User comments and @Claude mentions within dashboard threads (SKILL.md).
- Boundary markers: The instructions lack explicit boundary markers or directives to ignore instructions embedded within the processed comments.
- Capability inventory: The skill can create or restyle dashboards, reply to comments, and generate "do next" action summaries based on data drivers.
- Sanitization: There is no mention of sanitization, validation, or escaping of the user-provided comment text before the agent processes it.
Audit Metadata