infographic-creator
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to create HTML files that fetch the @antv/infographic library from unpkg.com, a well-known public package registry.
- [REMOTE_CODE_EXECUTION]: The skill facilitates remote code execution by generating HTML files that execute JavaScript logic in the user's browser environment to render visualizations.
- [COMMAND_EXECUTION]: The skill uses local file-writing capabilities to save generated HTML content to the filesystem.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted user data and interpolates it into a script template. Ingestion points: User-provided text content used to build the infographic. Boundary markers: None; content is wrapped in backticks within a script tag. Capability inventory: Generating local HTML files and executing JavaScript. Sanitization: No escaping or sanitization logic is specified to prevent malicious input from breaking out of the JavaScript string.
Audit Metadata