dashboard-builder
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEMETADATA_POISONINGINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [METADATA_POISONING]: The skill metadata lists 'Claude Code' as the author, which is inconsistent with the vendor 'inbharatai' identified in the provided context and the repository URL.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process 'live data sources,' which introduces an attack surface for indirect prompt injection if those external sources contain malicious instructions.
- Ingestion points: External data sources referenced in SKILL.md used to populate dashboards.
- Boundary markers: No specific delimiters or boundary markers are defined for the ingested data.
- Capability inventory: The skill generates executable dashboard code (Streamlit, Plotly).
- Sanitization: The guidelines explicitly instruct to 'Always validate inputs before processing,' which serves as a mitigation factor.
- [NO_CODE]: The skill consists solely of instructions in SKILL.md and does not include any accompanying scripts or executable files.
Audit Metadata