data-storytelling
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and transform raw data into narratives, which creates a surface for indirect prompt injection if the user-provided data contains malicious instructions. * Ingestion points: User-provided analytics, data reports, and market figures as described in the storytelling frameworks. * Boundary markers: No explicit delimiters or instructions to ignore embedded commands are included in the skill. * Capability inventory: The skill uses Python scripts (matplotlib, pandas) for data visualization. * Sanitization: There are no instructions for sanitizing or validating the input data before processing.
- [DYNAMIC_EXECUTION]: The skill includes Python code snippets for generating visualizations. The agent may dynamically generate and execute similar scripts based on user data, which is a low-severity execution pattern when using standard libraries like matplotlib and pandas.
Audit Metadata