d3-viz
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documentation and templates (e.g.,
SKILL.mdandassets/interactive-template.jsx) provide code patterns that ingest external data and render it directly into the DOM using the.html()method for tooltips. - Ingestion points: External data objects passed to visualisation functions (e.g.,
drawChart(data)orInteractiveChart({ data })). - Boundary markers: The provided examples do not include delimiters or warnings to ignore instructions embedded within the data values.
- Capability inventory: The skill demonstrates the capability to select the document
body, appenddivelements, and set their content dynamically based on data attributes liked.labelord.value. - Sanitization: No sanitization, HTML escaping, or validation logic is included in the templates to prevent the execution of malicious scripts or instructions contained within the data.
Audit Metadata