frame-data-chart-nyt
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided data (CSV, JSON, or descriptive text) and interpolates it into an HTML template for visualization.\n
- Ingestion points: Ingests raw data inputs defined in
SKILL.mdandexample.md.\n - Boundary markers: Lacks explicit delimiters or instructions to treat embedded data as untrusted.\n
- Capability inventory: Generates interactive HTML and SVG content for video surfaces.\n
- Sanitization: Does not specify escaping or validation of user-contributed labels or values before rendering.\n- [EXTERNAL_DOWNLOADS]: Loads design assets and styling libraries from well-known services.\n
- Evidence:
example.htmlincludes references to Tailwind CSS CDN and Google Fonts.
Audit Metadata