data-analysis
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill generates HTML reports that load the 'Chart.js' library from 'jsDelivr' and fonts from 'Google Fonts'. These are well-known services used for visualization and typography.
- [PROMPT_INJECTION]: The skill processes user-uploaded data, which presents a surface for indirect prompt injection or cross-site scripting in the generated report.
- Ingestion points: User-provided CSV and Excel files defined in SKILL.md.
- Boundary markers: No explicit delimiters or instructions to disregard embedded commands in the data are provided to the model.
- Capability inventory: The agent uses 'pandas' to read files and generates a local HTML report file.
- Sanitization: The instructions do not explicitly require the model to sanitize data values before including them in the HTML template's JavaScript block.
- [SAFE]: The core functionality of the skill follows established data analysis workflows and utilizes common Python packages without any evidence of malicious intent or unauthorized actions.
Audit Metadata