data-report

Pass

Audited by Gen Agent Trust Hub on Jul 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches resources from well-known and reputable services.
  • Downloads the Chart.js library from jsDelivr's CDN (cdn.jsdelivr.net).
  • Loads the Tailwind CSS framework from its official CDN (cdn.tailwindcss.com).
  • Fetches typography from Google Fonts (fonts.googleapis.com).
  • [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it processes external data for rendering.
  • Ingestion points: Processes user-supplied CSV, Excel, or JSON data as described in the SKILL.md instructions and demonstrated in example.md.
  • Boundary markers: The instructions do not explicitly require the agent to use specific delimiters or "ignore instructions" tags when interpolating data into the HTML template.
  • Capability inventory: The skill generates HTML and JavaScript to be executed in a browser environment, utilizing Chart.js for data rendering.
  • Sanitization: The provided example code in example.html uses .innerHTML to insert data into the DOM, which could allow for cross-site scripting (XSS) if the input data contains malicious script tags.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 14, 2026, 02:29 AM