qinyan-nature-figures
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill incorporates a local script
scripts/figure_preflight.pywhich the agent is instructed to run during the figure generation process. Analysis of the script confirms it is a benign utility that uses standard Python libraries (ast, re, json) to perform static syntax checks and metadata validation on generated Python or R source code. It does not execute the code it analyzes. - [DYNAMIC_EXECUTION]: The skill's primary function involves generating and executing Python (matplotlib/seaborn) or R (ggplot2) scripts. This is standard behavior for data visualization agents. The skill mitigates risks by providing a 'Figure Contract' and a pre-flight script to ensure the generated code meets safety and quality standards before execution.
- [INDIRECT_PROMPT_INJECTION]: The agent processes external research data to create visualizations. While this introduces an attack surface where data might influence code generation, the skill establishes clear boundary markers via the 'Figure Contract' and mandates a 'Preflight and visual QA' step to ensure resulting figures match the intended scientific evidence, reducing the impact of potential adversarial inputs in datasets.
Audit Metadata