ccf-visual-composer
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions and associated files do not contain any malicious patterns or deceptive content. The primary focus is on providing design standards and technical recipes for scientific plotting.
- [DYNAMIC_EXECUTION]: The included Python script
resources/python/ccfa_plot_recipes.pyis used to programmatically generate SVG images. This script is safe as it uses only built-in Python modules such asmath,xml.etree, andhtml, and it does not execute external commands or interact with the network. - [INDIRECT_PROMPT_INJECTION]: While the skill is designed to ingest and visualize user-supplied data, it follows security best practices. The plotting logic includes sanitization for text labels using
html.escape(), which prevents the injection of malicious SVG or XML tags via user data. - [REMOTE_CODE_EXECUTION]: No remote code execution patterns were identified. All dependencies are internal or standard, and there are no instructions for the agent to download or run untrusted external scripts.
Audit Metadata