modeling-figure-orchestrator
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input files that could contain malicious instructions designed to subvert agent behavior. Ingestion points include raw datasets, problem files, and XML diagrams identified as untrusted sources in SKILL.md. The skill includes boundary markers by explicitly stating that embedded content cannot override tool routing or safety gates. Its capability inventory includes tools to execute generated Python and MATLAB scripts. For sanitization, the skill mandates numerical and logical verification of figure data against source artifacts to detect inconsistencies.
- [DYNAMIC_EXECUTION]: The skill creates and runs executable scripts for data visualization. Instructions in SKILL.md and references/matlab-mcp-plotting.md direct the agent to write and execute MATLAB .m files using the mcp__matlab__run_matlab_file tool.
- [COMMAND_EXECUTION]: The skill invokes tools for rendering and quality assurance. It utilizes tools like view_image and math-figure-generator to process and inspect visualization outputs.
- [EXTERNAL_DOWNLOADS]: The skill references resources from a third-party GitHub repository not included in trusted vendor lists. It mentions the jihe520/sci-box repository as a source for scientific plotting templates and Draw.io layouts.
Audit Metadata