tufte-chart
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data for rendering charts. Ingestion points: Data enters via command-line arguments or JSON files in render_line_svg.py, small_multiples.py, quartile_plot.py, and range_frame.py. Boundary markers: User-provided strings are encapsulated in SVG text elements. Capability inventory: Local file writing in all rendering scripts and wrap_html.py; no network or subprocess capabilities. Sanitization: Robust sanitization via HTML escaping in _svg_text.py and an active-content blocklist in wrap_html.py.
- [DYNAMIC_EXECUTION]: The wrap_html.py module includes a security scanner that identifies and rejects SVGs with potentially malicious constructs like script tags, event handlers, or javascript: URLs.
- [COMMAND_EXECUTION]: Rendering logic is self-contained in local Python scripts without third-party package dependencies or remote code execution.
- [DATA_EXFILTRATION]: No network access or data transmission capabilities are present in the provided scripts.
- [CREDENTIALS_UNSAFE]: No hardcoded credentials or access to sensitive system configuration files were observed.
Audit Metadata