neo4j-nvl-skill
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external graph data from Neo4j databases for visualization, which represents a potential surface for indirect prompt injection if the source data is compromised.
- Ingestion points: Cypher query results retrieved via
driver.executeQuery(SKILL.md, references/api-surface.md). - Boundary markers: Data is processed through the
nvlResultTransformerutility, which maps database records into library-specific Node and Relationship schemas. - Capability inventory: The skill provides instructions for browser-based rendering and interaction; it does not contain capabilities for file system access, network exfiltration, or operating system command execution.
- Sanitization: Visual rendering is performed via Canvas or WebGL2, reducing common DOM-based script injection risks, though the library supports optional HTML overlays via specific properties.
- [EXTERNAL_DOWNLOADS]: The skill documentation references the installation of official packages from the
@neo4j-nvlscope on the npm registry and links to official Neo4j starter templates hosted on GitHub.
Audit Metadata