data-chart
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were identified. The skill serves its stated purpose of chart generation using standard libraries.
- [DYNAMIC_EXECUTION]: The skill involves generating and executing Python scripts locally using matplotlib and the uv tool. This is a standard workflow for data visualization and does not include unsafe practices like executing remote code or untrusted deserialization.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided data for chart rendering, which is an ingestion point for untrusted content (Ingestion point: user prompts). It does not use explicit boundary markers or sanitization (Sanitization: absent). Its capabilities are limited to local file writing and script execution (Capability inventory: scripts/editorial_mpl.py). Given its primary function as a visualization tool, the risk of indirect injection is negligible.
Audit Metadata