Skills
Navigate
skills/terminalskills/skills/echarts/Gen Agent Trust Hub

echarts

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides standard terminal commands for installing development dependencies using package managers.
  • Evidence: npm install echarts, npm install echarts echarts-for-react, and npm install echarts vue-echarts in SKILL.md.
  • [EXTERNAL_DOWNLOADS]: Fetches established visualization libraries from the official npm registry.
  • Evidence: Installation of echarts, echarts-for-react, and vue-echarts package names in SKILL.md.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing external data which could contain malicious instructions or scripts if the input is not sanitized.
  • Ingestion points: Data objects passed to chart.setOption() and ReactECharts components in SKILL.md.
  • Boundary markers: Not explicitly defined in code snippets, as data format is dictated by the ECharts API.
  • Capability inventory: File system write capability via writeFileSync in server-side examples.
  • Sanitization: The skill includes a dedicated security guideline (Guideline 10) explicitly instructing developers to escape user-supplied text using echarts.format.encodeHTML() to mitigate XSS risks.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 08:48 AM