chartjs
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface due to its primary function of processing external data for visualization.
- Ingestion points: The skill is triggered by user-uploaded data or data visualization requests (SKILL.md).
- Boundary markers: No specific delimiters or instructions to ignore embedded commands within user data are mentioned in the configuration snippets.
- Capability inventory: The skill can generate complete HTML files containing JavaScript (SKILL.md) and may use browser tools like Puppeteer for screenshots.
- Sanitization: No explicit sanitization or input validation for labels or data values is demonstrated in the provided code examples.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of external libraries for functionality.
- Remote source: Fetches the Chart.js library from the JSDelivr CDN via a script tag.
- Context: This is standard usage for the library and originates from a well-known service.
Audit Metadata