data-visualizer
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided data to generate visualization code in HTML, React, and Mermaid formats, which creates a potential surface for instructions embedded in data to influence the visualization logic.
- Ingestion points: Input data provided for chart and dashboard generation in SKILL.md.
- Boundary markers: No specific delimiters or "ignore instructions" markers for input data are explicitly defined in the skill files.
- Capability inventory: Generates HTML/React files and invokes other ecosystem skills (moai-officer, moai-writer) for file conversion and review.
- Sanitization: No explicit data sanitization or escaping mechanisms for the input data are described in the instructions.
- [EXTERNAL_DOWNLOADS]: Fetches the Chart.js library from a well-known public content delivery network.
- Evidence: The skill uses "https://cdn.jsdelivr.net/npm/chart.js" to render charts, as specified in references/data-visualizer/guide.md.
- [DYNAMIC_EXECUTION]: Generates executable dashboard code (HTML/React) at runtime based on user data and selected visualization strategies.
- Evidence: The skill assembles index.html and React components using libraries like Recharts, Chart.js, and Tremor as described in the Outputs section of SKILL.md.
Audit Metadata