matplotlib

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill involves ingesting data for visualization, which presents a surface for indirect prompt injection if the source data is malicious or untrusted.
  • Ingestion points: Data variables and arrays passed to plotting functions such as ax.plot(), ax.scatter(), and ax.imshow() in SKILL.md.
  • Boundary markers: No specific boundary markers or instructions to disregard embedded commands in data are present.
  • Capability inventory: The skill demonstrates file-writing capabilities through plt.savefig() in SKILL.md.
  • Sanitization: There is no mention of input validation or sanitization for the data being processed.
  • [COMMAND_EXECUTION]: The documentation guides users to execute local Python scripts distributed as part of the skill.
  • Evidence: SKILL.md provides instructions to run python scripts/plot_template.py and python scripts/style_configurator.py.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 04:47 AM