dataviz
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides robust accessibility guidelines (CVD safety, contrast minimums) and specifically instructs the agent to use
textContentwhen handling untrusted data to prevent XSS. - [COMMAND_EXECUTION]: The skill includes local JavaScript and Python scripts (
scripts/validate_palette.js,scripts/validate_palette.py) used for computing color safety metrics. These scripts perform mathematical color conversions and do not exhibit dangerous behaviors such as network access or shell injection. - [INDIRECT_PROMPT_INJECTION]: The skill identifies that labels and series names may come from untrusted sources (APIs, CSVs) and mandates the use of safe DOM APIs (
textContent,createTextNode) to mitigate risks. - [DATA_EXPOSURE]: No sensitive file paths, credentials, or exfiltration patterns were detected. The scripts operate entirely on local input provided via CLI arguments or data attributes.
Audit Metadata