risk-heatmap
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were detected in the skill instructions or the provided script.
- [COMMAND_EXECUTION]: The skill provides a Python script (
scripts/generate_risk_heatmap.py) intended for the agent to execute. The script is self-contained, uses standard Python libraries, and includes input validation to ensure it processes valid risk data. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it processes untrusted user-supplied risk entries to generate an HTML report. This surface is assessed as safe based on the following:
- Ingestion points: User-provided risk data (ID, name, description, owner, mitigation) is ingested by the
scripts/generate_risk_heatmap.pyscript via command-line arguments or JSON files. - Boundary markers: No specific delimiters are required by the instructions, but data is handled through structured JSON processing.
- Capability inventory: The script has the capability to write the generated report to a local file when an output path is provided via the
--outputflag. - Sanitization: The script correctly uses
html.escape()for all interpolated user content (project name, risk IDs, names, categories, owners, and mitigation measures) before rendering the final HTML, effectively preventing Cross-Site Scripting (XSS) and related injection attacks.
Audit Metadata