jinko-trial-viz
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
jinko.cli.trial_vizconsole script and Python SDK subservices to perform operations such as creating, updating, and sanity-checking trial visualizations. These commands are standard operations within the Jinkō project environment. - [EXTERNAL_DOWNLOADS]: The documentation references the installation of prerequisite skills from the
novainsilico/jinko-skillsrepository. This targets the vendor's own ecosystem and is part of the required environment setup for the SDK. - [INDIRECT_PROMPT_INJECTION]: The skill processes trial visualization configurations, including the ability to create visualizations from JSON payloads, which presents a surface for indirect prompt injection if processing untrusted data.
- Ingestion points:
trial.create_trial_visualization_from_json(data, ...)inSKILL.mdandreferences/trial-viz-typed-api.md. - Boundary markers: The instructions explicitly require running
viz.sanityafter all creation or update operations to validate the configuration. - Capability inventory: The skill uses the SDK to list, get, create, and patch visualization items within the user's project.
- Sanitization: The skill employs a typed API and a dedicated diagnostic service (
viz.sanity) to detect and report errors or warnings in the visualization payload before finalization.
Audit Metadata