visualize-data
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- Indirect Prompt Injection Surface: The skill is designed to ingest and process quantitative data rows for visualization. Because this data is used to populate HTML templates and JavaScript-based charts, there is a theoretical surface for indirect prompt injection if the source data contains malicious payloads. This is a common consideration for tools that transform data into rendered content.
- Dynamic Code and Content Generation: A core feature of the skill is the generation of Python code (for Matplotlib) and HTML/JavaScript (for Recharts and app blocks). This dynamic execution allows the agent to create tailored visualizations based on the specific analytical questions being asked.
- Execution of Local Build Tools: The process for generating portable HTML reports includes a step to run an internal Python script (
embed_html_report_runtime.py). This script resides within the local plugin directory and is used to bundle necessary runtimes into the final artifact without relying on external CDNs. - Integration with Native UI Widgets: The skill uses specific platform control tokens to wrap JSON payloads for the host's rendering engine. These delimiters allow the agent to surface interactive UI elements directly within the chat interface, which is a standard integration pattern for this environment.
Audit Metadata