data-viz-deck
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data sources such as audit markdown, CSV, and JSON files, which represents a potential surface for indirect prompt injection.\n
- Ingestion points: The workflow involves reading and parsing external files (audit markdown, CSV, JSON, or database query results) as described in SKILL.md and referenced in the parsing utilities in REFERENCE.md.\n
- Boundary markers: The skill does not implement explicit delimiters or instructions to ignore potential commands embedded within the data sources.\n
- Capability inventory: The skill utilizes file-writing capabilities to generate PPTX decks (REFERENCE.md), HTML dashboards (SKILL.md), and PNG images (REFERENCE.md) across its scripts.\n
- Sanitization: Utility functions in REFERENCE.md perform basic numeric validation using regular expressions, but there is no specific sanitization to prevent the interpretation of embedded natural language instructions.\n- [EXTERNAL_DOWNLOADS]: The skill utilizes standard external libraries and refers to its official source code repository.\n
- The installation process involves cloning from the author's GitHub repository (github.com/thatrebeccarae) as documented in SKILL.md.\n
- It requires the installation of standard data science packages including matplotlib and plotly.\n
- The HTML dashboard deliverable loads plotly.js via a well-known content delivery network (CDN) at runtime.
Audit Metadata