data-report
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and loads the Chart.js library and Tailwind CSS framework from well-known services (jsDelivr and Tailwind CDN) to facilitate report styling and chart rendering.
- [INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is the ingestion and processing of untrusted user data (CSV, Excel, JSON), which constitutes a potential attack surface for indirect prompt injection.
- Ingestion points: External data files provided by the user as input for the report generation.
- Boundary markers: The skill instructions do not define specific delimiters or instructions for the agent to ignore potential commands embedded within the data values.
- Capability inventory: The skill's operation is limited to generating static HTML and client-side JavaScript for visualization; it does not request or use tools for network communication, file system modification, or shell command execution.
- Sanitization: There are no explicit requirements or logic provided for the validation or escaping of user-supplied data strings before they are interpolated into the report template.
Audit Metadata