generate-publication-plots
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided datasets for visualization, which represents a potential indirect injection surface. Ingestion points: User-supplied data frames passed to the
dataparameter for plotting. Boundary markers: The skill instructions do not define specific delimiters or instructions to isolate untrusted data content from the agent's logic. Capability inventory: The skill utilizes theggsavefunction to write files to the local file system. Sanitization: The documentation does not mention sanitizing or validating data values or labels before they are rendered in plots. - [SAFE]: All identified code snippets and instructional workflows align with the legitimate purpose of scientific data visualization. No evidence of obfuscation, prompt injection, unauthorized network access, or persistence mechanisms was found. The referenced R packages, including ggplot2, viridis, RColorBrewer, and patchwork, are industry-standard tools for this domain.
Audit Metadata