jinko-trial-viz

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the jinko.cli.trial_viz console script and Python SDK subservices to perform operations such as creating, updating, and sanity-checking trial visualizations. These commands are standard operations within the Jinkō project environment.
  • [EXTERNAL_DOWNLOADS]: The documentation references the installation of prerequisite skills from the novainsilico/jinko-skills repository. This targets the vendor's own ecosystem and is part of the required environment setup for the SDK.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes trial visualization configurations, including the ability to create visualizations from JSON payloads, which presents a surface for indirect prompt injection if processing untrusted data.
  • Ingestion points: trial.create_trial_visualization_from_json(data, ...) in SKILL.md and references/trial-viz-typed-api.md.
  • Boundary markers: The instructions explicitly require running viz.sanity after all creation or update operations to validate the configuration.
  • Capability inventory: The skill uses the SDK to list, get, create, and patch visualization items within the user's project.
  • Sanitization: The skill employs a typed API and a dedicated diagnostic service (viz.sanity) to detect and report errors or warnings in the visualization payload before finalization.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 03:28 PM