high-signal-chart-workflow
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install several Python packages, including standard libraries like
matplotlib,pandas,pillow, andrequests, as well as the vendor's CLI toolgoodeyeviapiporpipxduring the optional customization phase.\n- [DATA_EXFILTRATION]: In Phase 5, the skill uploads the generatedchart.pngtohttps://litterbox.catbox.moe/resources/internals/api.phpviacurl. This upload to an anonymous public file-sharing service is used to provide a URL for the Truesight design evaluator, but it exposes agent-generated artifacts to a third-party host.\n- [COMMAND_EXECUTION]: The skill relies on numerous shell commands to manage its lifecycle, including environment creation (uv venv), dataset retrieval (curl), and interactions with the vendor platform viagoodeye loginandgoodeye templates fork.\n- [EXTERNAL_DOWNLOADS]: Phase 2 involves searching and downloading data directly from institutional domains (e.g., cdc.gov, census.gov, bls.gov, eia.gov) usingcurl.
Audit Metadata