skills/openai/plugins/build-dashboard/Gen Agent Trust Hub

build-dashboard

Pass

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • Command Execution for Validation and Delivery: The skill employs local command-line tools like npm and streamlit to validate dashboard artifacts and launch dashboard applications. These actions are performed within the local development context for the intended purpose of dashboard quality assurance and delivery.\n- Indirect Prompt Injection Surface: The workflow involves gathering context from potentially untrusted sources such as ~~company_docs and ~~team_communication. \n
  • Ingestion points: Data is ingested from internal documentation and communication channels as specified in SKILL.md.\n
  • Boundary markers: The skill incorporates a 'Source Access Guardrail' to verify source availability and permissions before proceeding with queries.\n
  • Capability inventory: Capabilities include generating manifest files, executing local commands, and publishing artifacts via $publish-artifact-to-sites.\n
  • Sanitization: The skill utilizes validation tools like validate_artifact and report:deliver to ensure payload safety and structural integrity before rendering.\n- Dynamic Application Generation: For Streamlit and MCP artifact delivery, the skill generates code and manifest files (artifact.json) that are subsequently processed or executed. The instructions prioritize the use of bounded snapshots and official validation tools to manage these dynamic outputs safely.\n- Source Access and Permission Management: The 'Source Access Guardrail' ensures that the agent verifies data source availability and permissions, explicitly handling blocked access to maintain transparency about data provenance.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 6, 2026, 11:17 AM
Security Audit — agent-trust-hub — build-dashboard