dashboard-design
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references Chart.js 4.x hosted on the jsdelivr CDN for rendering visualizations in generated HTML files. This is a well-known service used for delivering web libraries and the reference is consistent with the skill's dashboard generation purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a framework for processing user-supplied metrics and categories to generate data visualizations, creating a surface for indirect prompt injection.
- Ingestion points: User-provided data for KPIs, hero charts, and table rows (Module 2, Module 4, Module 7).
- Boundary markers: The skill does not explicitly instruct the agent to use delimiters or sanitization when interpolating user data into the generated HTML/JavaScript.
- Capability inventory: The skill facilitates the generation of functional HTML and JavaScript files intended for browser execution.
- Sanitization: No specific validation or escaping mechanisms are provided for the generated output scripts.
Audit Metadata