data-report
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches resources from well-known and reputable services.
- Downloads the Chart.js library from jsDelivr's CDN (cdn.jsdelivr.net).
- Loads the Tailwind CSS framework from its official CDN (cdn.tailwindcss.com).
- Fetches typography from Google Fonts (fonts.googleapis.com).
- [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it processes external data for rendering.
- Ingestion points: Processes user-supplied CSV, Excel, or JSON data as described in the
SKILL.mdinstructions and demonstrated inexample.md. - Boundary markers: The instructions do not explicitly require the agent to use specific delimiters or "ignore instructions" tags when interpolating data into the HTML template.
- Capability inventory: The skill generates HTML and JavaScript to be executed in a browser environment, utilizing Chart.js for data rendering.
- Sanitization: The provided example code in
example.htmluses.innerHTMLto insert data into the DOM, which could allow for cross-site scripting (XSS) if the input data contains malicious script tags.
Audit Metadata