high-signal-chart-workflow

Pass

Audited by Gen Agent Trust Hub on May 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install several Python packages, including standard libraries like matplotlib, pandas, pillow, and requests, as well as the vendor's CLI tool goodeye via pip or pipx during the optional customization phase.\n- [DATA_EXFILTRATION]: In Phase 5, the skill uploads the generated chart.png to https://litterbox.catbox.moe/resources/internals/api.php via curl. This upload to an anonymous public file-sharing service is used to provide a URL for the Truesight design evaluator, but it exposes agent-generated artifacts to a third-party host.\n- [COMMAND_EXECUTION]: The skill relies on numerous shell commands to manage its lifecycle, including environment creation (uv venv), dataset retrieval (curl), and interactions with the vendor platform via goodeye login and goodeye templates fork.\n- [EXTERNAL_DOWNLOADS]: Phase 2 involves searching and downloading data directly from institutional domains (e.g., cdc.gov, census.gov, bls.gov, eia.gov) using curl.
Audit Metadata
Risk Level
SAFE
Analyzed
May 19, 2026, 03:05 AM
Security Audit — agent-trust-hub — high-signal-chart-workflow