data-story-charts
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the GSAP animation library from the JSDelivr CDN (https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js).
- [EXTERNAL_DOWNLOADS]: The skill utilizes npx to download and initialize the 'hyperframes' package from the NPM registry.
- [COMMAND_EXECUTION]: The skill requires the execution of shell commands (node, ffmpeg, npx) for project initialization, content validation, and video rendering.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied statistics and data tables to drive the visual output of the charts, which represents a data ingestion surface.
- Ingestion points: User-provided datasets or files are read to generate chart coordinates and labels (SKILL.md).
- Boundary markers: The instructions explicitly state to "Use only real numbers the user gave" and "Never invent data."
- Capability inventory: The skill uses npx and ffmpeg for rendering and executes JavaScript animation logic in a browser or Node.js context.
- Sanitization: While no explicit sanitization logic is described for the interpolated data, the skill focus is on numeric data processing for SVG paths.
Audit Metadata