blog-chart
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: The skill serves as a formatting guide for SVG data visualization and does not contain any executable scripts, system commands, or external network requests.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a process for transforming user-supplied data into SVG markup, which creates a potential surface for indirect injection. Ingestion points: Data fields within the 'Chart Request' structure in SKILL.md. Boundary markers: The instructions use standard SVG title and description tags to contain data, but they lack explicit directives for the agent to sanitize or escape these strings against potential markup injection. Capability inventory: The skill environment is configured with Read, Write, Edit, Bash, and Grep tools, though the chart generation instructions themselves are purely declarative. Sanitization: No explicit validation, filtering, or escaping of input data strings is specified in the provided workflow.
Audit Metadata