d3-animated-data-visualization
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions for processing external data and approved claims to generate D3.js code establish an attack surface for indirect prompt injection.
- Ingestion points: The skill defines a "data contract" that ingests data from external URLs and identifiers (SKILL.md).
- Boundary markers: The skill requires establishing "approved claims" and boundaries for what a visualization must not imply, acting as conceptual constraints (SKILL.md).
- Capability inventory: The agent generates JavaScript code for D3 marks, scales, and frame-by-frame rendering logic (SKILL.md).
- Sanitization: While the skill emphasizes data integrity and QA passes, it does not explicitly detail the technical sanitization of data strings to prevent malicious instructions from influencing agent behavior.
- [EXTERNAL_DOWNLOADS]: The skill references documentation and standards from trusted organizations and well-known services.
- Evidence: The skill provides links to official D3.js documentation (d3js.org), W3C accessibility guidelines (w3.org), and the Royal Statistical Society (SKILL.md).
Audit Metadata