dashboard-builder
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The provided
setup-and-run.shscript automates project initialization by generating configuration files and boilerplate code for the dashboard application. This is a standard feature for development tools and project scaffolding. - [EXTERNAL_DOWNLOADS]: The
WorldMapChartcomponent fetches map topology data fromhttps://cdn.jsdelivr.net/npm/world-atlas@2/countries-110m.json. This is a well-known and trusted source for geographic assets. - [INDIRECT_PROMPT_INJECTION]: The skill creates an application surface that ingests data from external sources (APIs, databases). While no immediate vulnerability is present, the skill relies on the user to implement proper sanitization for the ingested data.
- Ingestion points: External data is processed via the
fetchDatautility anduseLiveDatahooks within the generated project files (e.g.,lib/api.ts). - Boundary markers: The templates do not include explicit instructions or markers to distinguish untrusted data from application logic.
- Capability inventory: The generated application includes capabilities for network requests and file writing (via the setup script).
- Sanitization: No built-in sanitization logic is provided in the templates for external data content.
Audit Metadata