data-viz
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill's instructions and metadata do not contain any detected malicious patterns such as prompt injection, obfuscated content, or unauthorized data access.
- [EXTERNAL_DOWNLOADS]: The skill references official CDN URLs for common visualization libraries (ECharts and Chart.js) hosted on jsDelivr. These are standard, well-known, and legitimate services used for serving web development assets.
- [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting user-provided data to generate code, which constitutes a standard attack surface for indirect prompt injection. However, as the skill lacks capabilities to execute code or access the file system, and the generated code is intended for user review, the risk is minimal.
- Ingestion points: User-provided data in the chat interface (referenced in Step 1).
- Boundary markers: Absent.
- Capability inventory: No direct tool usage; the skill only generates text and code snippets.
- Sanitization: Absent.
Audit Metadata