claude-d3js-skill
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill consists of documentation and React-based code templates for data visualization. No evidence of malicious behavior, data exfiltration, or unauthorized command execution was found.
- [EXTERNAL_DOWNLOADS]: The skill references the official d3.js library via its well-known CDN (d3js.org) and mentions the standard d3-interpolate-path package. These are reputable sources within the JavaScript ecosystem.
- [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection by processing external data for visualization. However, it specifically includes instructions to mitigate risks like XSS by using text nodes for untrusted data. * Ingestion points: Data ingested in assets/chart-template.jsx, assets/interactive-template.jsx, and references/d3-patterns.md. * Boundary markers: None present for instructions, but validation for finite numeric values and unique keys is recommended in the guide. * Capability inventory: The skill only performs SVG rendering and DOM manipulation; it lacks capabilities for network communication or local file system access. * Sanitization: The detailed guide in references/detailed-guide.md explicitly mandates using text nodes for labels and avoiding interpolation into HTML to prevent injection attacks.
Audit Metadata