matplotlib

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill provides scripts (scripts/plot_template.py) and examples that ingest data to generate visualizations. If the agent populates plot labels, titles, or data points from untrusted external sources, it could lead to metadata injection in output files (e.g., PDF/SVG) or schema confusion.\n
  • Ingestion points: Command-line arguments in scripts/plot_template.py and interactive input() in scripts/style_configurator.py.\n
  • Boundary markers: Absent.\n
  • Capability inventory: File writing via fig.savefig() and save_style_file() in the helper scripts.\n
  • Sanitization: No explicit validation or sanitization is implemented for the data passed to plotting functions.\n- [COMMAND_EXECUTION]: The helper script scripts/style_configurator.py uses interactive input() calls which can cause execution hangs or be manipulated if the agent's environment does not handle interactive shell sessions securely.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 02:34 PM