plot-ml-figure
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes machine learning data structures (DataFrames, Series) to generate visualization code. This creates a surface where maliciously crafted data values or metadata could attempt to influence the agent's code generation logic.
- Ingestion points: Data input from calling skills (
explore-ml-data,evaluate-ml-pipeline,audit-ml-pipeline) in the form of Pandas or Polars objects. - Boundary markers: None specified in the instructions to separate data content from code generation logic.
- Capability inventory: The skill possesses the ability to execute Python code for plotting, write files to the local filesystem (PNG and HTML), and utilize package management tools.
- Sanitization: No specific sanitization or validation of data content is mentioned before it is processed for plotting.
- [EXTERNAL_DOWNLOADS]: The instructions direct the agent to use the
add-python-packagetool if required plotting libraries are missing. This is a standard operational procedure for the skill's environment. - [COMMAND_EXECUTION]: The skill generates Python code that utilizes common visualization libraries (Seaborn, Matplotlib, Plotly). While it involves code execution, it is constrained to the primary purpose of data visualization.
Audit Metadata