kpi-dashboard-design
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides templates for processing external data from database tables which could contain untrusted input.
- Ingestion points: SQL queries in
resources/metric-queries.sqltarget theusers,events,spend, andmonthly_revenuetables. - Boundary markers: Absent; the provided templates do not include delimiters or instructions to ignore embedded instructions within the processed data.
- Capability inventory: SQL execution and data aggregation capabilities.
- Sanitization: No sanitization, validation, or escaping logic is implemented for the data retrieved from the database.
- [EXTERNAL_DOWNLOADS]: The Python implementation example in
SKILL.mdreferences the use of standard data science and visualization libraries. - Evidence: The code snippet imports
streamlit,pandas, andplotly, which are well-known and established libraries in the Python ecosystem.
Audit Metadata