d3-viz
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official D3.js library via its official CDN at d3js.org.\n- [PROMPT_INJECTION]: The templates provided in
SKILL.mdandassets/interactive-template.jsxused3.selection.html()to render tooltips based on data properties, creating a surface for indirect prompt injection.\n - Ingestion points: Data properties such as
d.labelinSKILL.mdandassets/interactive-template.jsxwhich are interpolated into tooltips.\n - Boundary markers: Absent; no explicit markers or instructions are provided to the agent to ignore potentially malicious content within the data.\n
- Capability inventory: The skill is restricted to DOM and SVG visualization rendering; no file-write or network exfiltration capabilities are present in the provided scripts (verified in
SKILL.mdandassets/interactive-template.jsx).\n - Sanitization: Absent; the implementation uses
.html()for data interpolation without sanitizing or escaping the content, allowing arbitrary HTML/script injection from the data source.
Audit Metadata