tremor-design-system

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for rendering dashboards and charts based on data ingested from the agent's context or external tools.
  • Ingestion points: Data variables such as chartdata and kpis in references/dashboard-patterns.md are used to populate React components.
  • Boundary markers: There are no explicit instructions for the agent to use delimiters or ignore instructions within the data being visualized.
  • Capability inventory: The skill focuses on UI generation and does not include scripts for file system modification, network requests, or command execution.
  • Sanitization: No specific sanitization or validation logic is defined for the data passed to the visualization components.
  • [EXTERNAL_DOWNLOADS]: The documentation references standard ecosystem dependencies required for the design system to function.
  • Evidence: references/component-catalog.md lists public packages including @tremor/react, recharts, radix-ui components, and date utilities.
  • Note: These references target well-known packages in the official registry and are consistent with the skill's stated purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 02:18 PM