light-figure
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The scripts r_ggplot.py and example_framework_render.py utilize the subprocess module to call external rendering engines (Rscript and dot). These commands are used solely to process local data into visual diagrams and statistical charts.
- [EXTERNAL_DOWNLOADS]: The skill identifies dependencies on standard scientific libraries for Python (matplotlib, seaborn, pandas, Pillow) and R (ggplot2, scales). These are well-established tools for research visualization and do not represent a security risk.
- [SAFE]: The r_ggplot.py module employs string escaping (via the _rstr function) when generating R code from user-supplied data, preventing potential script injection. The skill also explicitly prohibits the use of generative AI models for data-driven images, maintaining high standards for scientific integrity.
Audit Metadata