academic-figure
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill generates and executes Python plotting scripts (using
matplotlibandseaborn) to produce SVG figures. This dynamic execution is the core functionality and is constrained by strict templates and instructions that prohibit modification of source code or data. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data (CSV, TSV, NumPy) to populate charts. This creates a surface for indirect prompt injection where malicious data could theoretically influence plotting logic, though the use of standard libraries and specific 'Figure Contracts' provides mitigation.
- [DYNAMIC_IMPORT]: The script
scripts/chart_template.pyutilizes__import__to check for the availability of thematplotlibandnumpylibraries. The imports are performed on a hardcoded list of strings, posing no risk of loading untrusted modules. - [DATA_EXPOSURE]: The skill requires reading local data files provided by the user for visualization. The instructions include explicit prohibitions against unauthorized file access or modification.
Audit Metadata