vtable-development-assistant
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes and executes local Python scripts (
scripts/generate_demo_html.pyandscripts/generate_diagnosis_html.py) to automate the creation of HTML-based demonstrations and troubleshooting reports. These scripts use local templates to generate output for the developer. - [EXTERNAL_DOWNLOADS]: Generated HTML files utilize common, well-known libraries (such as
@visactor/vtable,@visactor/vchart, andmonaco-editor) hosted oncdn.jsdelivr.net. These are official distribution points for the libraries the skill is designed to assist with. - [DYNAMIC_EXECUTION]: The skill generates interactive environments where user-provided VTable configurations are evaluated in the browser using the
new Function()constructor. This is a standard pattern for live-code editors and diagnostic tools within a development context. - [INDIRECT_PROMPT_INJECTION]: As a tool that processes user code and data to generate visual outputs, the skill has an inherent surface for indirect prompt injection. However, the risk is minimized by basic sanitization (e.g., removing module import/export statements) and the intended use case of creating developer-facing tools.
Audit Metadata