tufte-report
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill generates HTML reports that reference well-known external resources, specifically Chart.js via the jsDelivr CDN and Monaspace fonts from GitHub's official repository. These references are used for data visualization and typography.
- [COMMAND_EXECUTION]: The skill includes a local preview utility (
scripts/serve.py) that the agent is instructed to execute. This script uses Python's standard library to set up a local HTTP and WebSocket server onlocalhost(ports 8042/8043) to enable live-reloading of reports during development. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and normalize external data sources (CSV, JSON, SQLite) into an intermediate format. As it processes untrusted user data to generate narrative text and visualizations, it possesses an inherent attack surface for indirect prompt injection, though the skill provides structured templates to mitigate accidental instruction execution.
- [DYNAMIC_EXECUTION]: The skill involves the generation of executable HTML/JavaScript content and may create the
serve.pyutility script from provided reference templates if it is not already present in the environment.
Audit Metadata