academic-figure

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill generates and executes Python plotting scripts (using matplotlib and seaborn) to produce SVG figures. This dynamic execution is the core functionality and is constrained by strict templates and instructions that prohibit modification of source code or data.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data (CSV, TSV, NumPy) to populate charts. This creates a surface for indirect prompt injection where malicious data could theoretically influence plotting logic, though the use of standard libraries and specific 'Figure Contracts' provides mitigation.
  • [DYNAMIC_IMPORT]: The script scripts/chart_template.py utilizes __import__ to check for the availability of the matplotlib and numpy libraries. The imports are performed on a hardcoded list of strings, posing no risk of loading untrusted modules.
  • [DATA_EXPOSURE]: The skill requires reading local data files provided by the user for visualization. The instructions include explicit prohibitions against unauthorized file access or modification.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 02:10 AM
Security Audit — agent-trust-hub — academic-figure