scientific-visualization
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements robust file handling in 'scripts/_common.py', including explicit rejection of symlinks and file size limits (200MB for inputs, 4MB for reports) to prevent symlink-based attacks and resource exhaustion.
- [SAFE]: 'scripts/image_metadata.py' includes specific security checks for SVG processing, such as a manual scan for internal DTD/entity declarations to mitigate XML External Entity (XXE) risks and a limit on total XML elements (100,000).
- [SAFE]: The skill handles raster images securely using Pillow, setting a maximum pixel limit (100 million) and catching decompression bomb warnings to prevent memory exhaustion attacks.
- [SAFE]: All external dependencies (Matplotlib, Seaborn, Plotly, Kaleido, Pillow, pypdf) are pinned to specific, recent versions and are well-established, trusted libraries in the scientific community.
- [SAFE]: The 'scripts/figure_export.py' utility uses atomic writing patterns (temporary files followed by an OS replace) to ensure file integrity and prevent partial writes or race conditions.
Audit Metadata