flint-chart-author
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- External Library Integration: The skill provides instructions for installing libraries like
flint-chartand its peer dependencies vianpm. These are standard requirements for the charting functionality described and are provided by a known organization. - MCP Server Execution: Instructions include running a Model Context Protocol (MCP) server using
npx. This is a common pattern for local tool execution in developer-oriented AI skills and matches the vendor's provided tooling. - Local File Access Capability: The system can reference local data files (JSON, CSV, TSV) via a URL parameter. The documentation helpfully highlights a security flag (
--disable-file-reference) to restrict this behavior in sensitive environments, which is a recommended security practice. - Indirect Prompt Injection Surface: The skill processes external tabular data entering through
data.valuesordata.url. While explicit boundary markers are not specified in the instructions, the guidance emphasizes using robust parsing methods (e.g.,d3.csvParse,pandas) rather than simple string splitting to ensure data integrity and prevent unintended data interpretation. The capabilities (rendering charts, installing project dependencies) are aligned with the primary purpose of the skill.
Audit Metadata