frame-data-chart-nyt
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-provided data formats such as CSV, JSON, or text conclusions to generate visual frames. While this creates an ingestion point for untrusted content, the skill lacks dangerous capabilities that would make such content exploitable. Ingestion points: External data is used to populate SVG paths and HTML text elements as described in SKILL.md. Boundary markers: None identified to delimit user-provided data from template instructions. Capability inventory: The skill generates visual output for rendering and does not include tools for network exfiltration, file system modification, or command execution. Sanitization: No explicit sanitization or validation logic for the input data is provided in the instructions.
- [EXTERNAL_DOWNLOADS]: The example implementation and instructions reference external assets from established and trusted technology providers. Evidence: The example HTML file fetches typography from Google Fonts and the Tailwind CSS library from its official CDN. The skill also references an upstream repository on GitHub and design inspiration from Heygen.
Audit Metadata