data2motion-lite
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: Extensive analysis of the skill's scripts and documentation revealed no malicious patterns, unauthorized data access, or persistence mechanisms. The primary function is the safe generation of SVG-based charts.
- [EXTERNAL_DOWNLOADS]: The generated HTML templates and showcase pages fetch styling resources (CSS and fonts) from well-known and reputable services, specifically Google Fonts and the JSdelivr CDN. These external dependencies are limited to static assets necessary for visual presentation.
- [COMMAND_EXECUTION]: The skill requires the execution of a local Python script (
scripts/build.py) to assemble the final chart. This script uses standard Python libraries to generate static HTML and does not incorporate dangerous command-line injection vectors or arbitrary shell execution. - [PROMPT_INJECTION]: The skill processes untrusted user data to populate chart labels and titles. While this creates a potential surface for indirect prompt injection, the risk is minimized because the content is rendered as static SVG text, and the build script sanitizes critical fields using HTML escaping, preventing the execution of malicious scripts in the browser.
Audit Metadata