lov-algo-viz-creator
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary function is generating educational visualizations. No prompt injection, unauthorized data exfiltration, or malicious persistence mechanisms were detected.
- [DATA_EXPOSURE]: The skill implements a local state management system via
scripts/profile_store.py, which stores user preferences and brand facts in~/.config/agent-skills/profile.json. The implementation is secure, using atomic writes, restrictive file permissions (0600), and a mandatory filter that blocks keys containing sensitive strings such as 'token', 'secret', 'password', or 'api_key'. - [DYNAMIC_EXECUTION]: The
scripts/build_viz.pyscript generates standalone HTML files by embedding JSON data into an engine template. It correctly mitigates potential script injection attacks by usingjson.dumpsand escaping characters that could be used to break out of the script context (e.g., replacing</with<\/). - [COMMAND_EXECUTION]: The skill executes local Python scripts provided within its own package to validate and build visualizations. These scripts use standard libraries and do not perform any hidden or suspicious operations.
Audit Metadata