data-charts-tako
Pass
Audited by Gen Agent Trust Hub on Apr 28, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill instructions involve reading an API key from a local configuration file at
~/.gooseworks/credentials.jsonto authenticate with the vendor's service. This is a standard practice for managing credentials for this type of tool. - [COMMAND_EXECUTION]: The skill uses
curlto make network requests toapi.gooseworks.aifor data retrieval and chart generation. It also suggests usingpython3locally to export configuration values from the credentials file. - [EXTERNAL_DOWNLOADS]: The documentation mentions
npx gooseworks loginfor user authentication, which refers to an external tool provided by the vendor. - [PROMPT_INJECTION]: The skill accepts natural language queries and CSV data from users. While this provides a surface for indirect prompt injection, the impact is confined to the data visualization service's outputs (charts and insights), and no risky capabilities such as arbitrary code execution are exposed to this untrusted data.
Audit Metadata