flint-chart-author

Pass

Audited by Gen Agent Trust Hub on Oct 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • External Library Integration: The skill provides instructions for installing libraries like flint-chart and its peer dependencies via npm. These are standard requirements for the charting functionality described and are provided by a known organization.
  • MCP Server Execution: Instructions include running a Model Context Protocol (MCP) server using npx. This is a common pattern for local tool execution in developer-oriented AI skills and matches the vendor's provided tooling.
  • Local File Access Capability: The system can reference local data files (JSON, CSV, TSV) via a URL parameter. The documentation helpfully highlights a security flag (--disable-file-reference) to restrict this behavior in sensitive environments, which is a recommended security practice.
  • Indirect Prompt Injection Surface: The skill processes external tabular data entering through data.values or data.url. While explicit boundary markers are not specified in the instructions, the guidance emphasizes using robust parsing methods (e.g., d3.csvParse, pandas) rather than simple string splitting to ensure data integrity and prevent unintended data interpretation. The capabilities (rendering charts, installing project dependencies) are aligned with the primary purpose of the skill.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 28, 2026, 01:28 PM