chartjs
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: CRITICALINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the Chart.js library from
cdn.jsdelivr.net, which is a well-known and trusted content delivery service for open-source libraries. - [INDIRECT_PROMPT_INJECTION]: The skill contains examples for ingesting data from external sources, which presents a potential vulnerability surface.
- Ingestion points: The CSV loading example in
SKILL.mdusesfetch('../data/sales.csv')to retrieve external data. - Boundary markers: Absent. There are no delimiters or instructions to treat the ingested data as untrusted content.
- Capability inventory: The skill uses standard browser-side JavaScript execution and HTML5 Canvas rendering.
- Sanitization: The code uses
parseFloatfor numeric conversion, which provides basic data validation, but it lacks sanitization for labels or headers extracted from the CSV file.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
Audit Metadata