video-dashboard
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill defines an explicit 'Untrusted content boundary' to manage data from transcripts and OCR. It instructs the agent to treat all external strings as data only and never as instructions, effectively mitigating indirect prompt injection risks.
- [SAFE]: The dashboard generation instructions mandate the use of
document.createElement()andtextContentwhen rendering external data. This approach prevents cross-site scripting (XSS) by ensuring that untrusted content (like transcript excerpts) cannot be executed as HTML or JavaScript. - [EXTERNAL_DOWNLOADS]: The skill installs the
chart.jslibrary usingnpm. It employs security best practices by using the--ignore-scriptsflag to block malicious lifecycle scripts and--save-exactto pin the dependency to a specific, reviewed version. - [COMMAND_EXECUTION]: A local web server is used for testing via
python -m http.server. The server is restricted to the local loopback address (127.0.0.1), which prevents unauthorized remote access to the project files while the dashboard is being viewed.
Audit Metadata