dashboard-builder
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external files (CSV, spreadsheets, folder contents) and incorporates it into a generated HTML dashboard. This creates a potential attack surface where malicious data could influence the agent's output or introduce web-based vulnerabilities like XSS.
- Ingestion points: The skill reads data from user-specified file paths, folders, spreadsheets, and pasted content.
- Boundary markers: The instructions do not specify explicit delimiters or "ignore embedded instructions" warnings for the ingested data.
- Capability inventory: The skill utilizes file system capabilities to read data and write interactive HTML files containing embedded JavaScript.
- Sanitization: While the skill is instructed to flag data quality issues, there are no specific requirements to sanitize or escape data before embedding it into the HTML/JS dashboard structure.
- [EXTERNAL_DOWNLOADS]: The skill instructions suggest using modern charting libraries such as Chart.js, Apache ECharts, or D3.js. These are typically included via public Content Delivery Networks (CDNs), which is standard practice for web-based dashboard development.
Audit Metadata