animated-chart
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data (titles, labels, and values) and incorporates it into generated HTML code.\n
- Ingestion points: User inputs for the chart title and data are interpolated into the prompt template used by the agent to write the HTML code in Prompt 1.\n
- Boundary markers: There are no explicit delimiters or instructions to the agent to escape or isolate these inputs from the surrounding code logic.\n
- Capability inventory: The skill involves writing code to the filesystem and executing shell commands for media conversion (e.g., creating MP4s and GIFs).\n
- Sanitization: The instructions do not define any validation or sanitization steps for the user-provided data.\n- [DYNAMIC_EXECUTION]: The skill generates and renders code containing animation logic. It specifically requests the implementation of a timing-based frame selection mechanism (
window.seek) to enable automated capturing of states via screenshots.\n- [COMMAND_EXECUTION]: The skill utilizes local CLI tools to perform media export tasks (MP4 and GIF creation). It includes a safety directive requiring the agent to inform the user before installing any required dependencies that are not already present on the system.
Audit Metadata