plotly
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as a documentation resource for the Plotly library, containing standard code snippets for data visualization and analysis. All package installations (plotly, pandas, kaleido, dash) are performed via standard package managers and all external links point to official documentation or the vendor's own research platform.
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for processing and visualizing data structures like DataFrames. This creates a potential surface for indirect prompt injection if an agent processes untrusted data containing malicious instructions. However, this is an inherent property of data processing tools and is considered safe within the intended use-case of the skill.
- Ingestion points: DataFrames and matrices passed to functions like px.scatter and go.Figure in SKILL.md and reference files.
- Boundary markers: None defined in the documentation snippets.
- Capability inventory: File-write operations (fig.write_html, fig.write_image) and network access for loading Plotly.js from a CDN.
- Sanitization: Standard library defaults are utilized without additional sanitization instructions.
Audit Metadata