tableau-dashboard-creator
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: Secret management follows best practices. The skill uses .env files for database credentials and provides a template (.env.example), avoiding hardcoded secrets in the code or instructions. Personae and instructions explicitly mention that load_dotenv() will search parent directories for existing secrets.
- [SAFE]: Database interactions are restricted to read-only operations via a dedicated Python helper script (scripts/query_postgresql.py). The script validates SQL queries against a robust list of forbidden keywords (e.g., INSERT, UPDATE, DELETE, DROP), uses read-only sessions, and enforces a hard limit of 500 rows on all result sets using a nested query wrapper to prevent limit bypasses.
- [SAFE]: External dependencies are restricted to standard, well-known libraries such as pandas, psycopg2-binary, and lxml. The interactive HTML mock fetches Chart.js from a well-known and trusted content delivery network (jsDelivr).
- [SAFE]: The skill uses personae and iterative feedback loops that maintain user oversight over all generated artifacts, including design tokens, data architecture, and XML workbooks.
- [SAFE]: No patterns of prompt injection, data exfiltration, persistence, or malicious obfuscation were identified in the instructions or supporting scripts. Base64 content detected in workbook snippets corresponds to standard Tableau image thumbnails.
Audit Metadata