d3-viz
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate guidance and templates for D3.js visualizations.
- [EXTERNAL_DOWNLOADS]: The skill references the official D3.js library via its legitimate CDN (d3js.org) and standard package imports. These resources are from a well-known service and are documented here for transparency.
- [DYNAMIC_EXECUTION]: The provided templates use standard D3.js DOM manipulation patterns. While the use of
.html()for tooltips in sample code is a common practice that requires data sanitization for production use, it is consistent with the skill's primary purpose as a developer resource. - [INDIRECT_PROMPT_INJECTION]: The skill defines a potential attack surface by ingesting external data to generate DOM elements. 1. Ingestion points: The visualization functions and React components in
SKILL.mdand theassets/folder accept externaldataobjects. 2. Boundary markers: No explicit delimiters or instructions are used to separate data from the rendering logic. 3. Capability inventory: The skill uses D3.js to create and manipulate SVG and HTML elements, including event listeners and raw HTML rendering. 4. Sanitization: Properties are occasionally rendered via.html()without sanitization in tooltip templates.
Audit Metadata