chart-generation
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill performs local data visualization using trusted libraries (matplotlib, numpy, pillow). No network operations, hardcoded credentials, or obfuscated code were found.
- [INDIRECT_PROMPT_INJECTION]: The skill's scripts ingestion points include command-line arguments used to generate chart content.
- Ingestion points: Command-line arguments including --labels, --values, and --title across all scripts (scripts/bar_chart.py, scripts/line_chart.py, scripts/pie_chart.py, scripts/positioning_matrix.py, scripts/comparison_table.py, and scripts/tam_sam_som.py).
- Boundary markers: The data is parsed as JSON, but there are no specific prompt boundaries or "ignore instructions" delimiters used when rendering user-provided text labels into images.
- Capability inventory: The scripts have the capability to write image files to the local file system using the matplotlib.pyplot.savefig function.
- Sanitization: Inputs undergo basic JSON structure validation via json.loads, but the string values are rendered directly into the generated images without specific content sanitization.
Audit Metadata