vchart-skill

This script generates a local diagnostic HTML file and shows no direct malware behavior, network communication, or credential theft. Untrusted CLI content can inject JavaScript into the generated HTML because template-literal and quoted-string contexts are not consistently escaped; severity depends on whether generated files are opened or served to users. The output destination is also CLI-controlled, with its path constraints dependent on the unprovided resolve_output_path() helper. Confidence is high that the interpolation flaw exists, but the shown undefined epilog identifier may prevent normal execution.