d3-viz
Pass
Audited by Gen Agent Trust Hub on Apr 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the D3.js library from the official d3js.org CDN, which is a well-known and trusted service.
- [PROMPT_INJECTION]: Identifies an indirect prompt injection surface within the data visualization processing logic. 1. Ingestion points: Data input via the 'data' parameter in drawing functions and React component props found in SKILL.md, assets/chart-template.jsx, and assets/interactive-template.jsx. 2. Boundary markers: Absent, with no instructions to ignore or isolate embedded content in the data. 3. Capability inventory: Utilizes D3.js for SVG manipulation and interactive tooltip creation in the document body. 4. Sanitization: Partial. While most labels are rendered using the safe .text() method, the tooltip implementations in SKILL.md and assets/interactive-template.jsx use .html(), which could execute HTML tags or scripts embedded in the data if the source is malicious.
Audit Metadata