tremor-design-system
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for rendering dashboards and charts based on data ingested from the agent's context or external tools.
- Ingestion points: Data variables such as
chartdataandkpisinreferences/dashboard-patterns.mdare used to populate React components. - Boundary markers: There are no explicit instructions for the agent to use delimiters or ignore instructions within the data being visualized.
- Capability inventory: The skill focuses on UI generation and does not include scripts for file system modification, network requests, or command execution.
- Sanitization: No specific sanitization or validation logic is defined for the data passed to the visualization components.
- [EXTERNAL_DOWNLOADS]: The documentation references standard ecosystem dependencies required for the design system to function.
- Evidence:
references/component-catalog.mdlists public packages including@tremor/react,recharts,radix-uicomponents, and date utilities. - Note: These references target well-known packages in the official registry and are consistent with the skill's stated purpose.
Audit Metadata