dashboard-builder

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The provided setup-and-run.sh script automates project initialization by generating configuration files and boilerplate code for the dashboard application. This is a standard feature for development tools and project scaffolding.
  • [EXTERNAL_DOWNLOADS]: The WorldMapChart component fetches map topology data from https://cdn.jsdelivr.net/npm/world-atlas@2/countries-110m.json. This is a well-known and trusted source for geographic assets.
  • [INDIRECT_PROMPT_INJECTION]: The skill creates an application surface that ingests data from external sources (APIs, databases). While no immediate vulnerability is present, the skill relies on the user to implement proper sanitization for the ingested data.
  • Ingestion points: External data is processed via the fetchData utility and useLiveData hooks within the generated project files (e.g., lib/api.ts).
  • Boundary markers: The templates do not include explicit instructions or markers to distinguish untrusted data from application logic.
  • Capability inventory: The generated application includes capabilities for network requests and file writing (via the setup script).
  • Sanitization: No built-in sanitization logic is provided in the templates for external data content.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 06:09 PM