chartjs-generator
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the Chart.js library from the jsDelivr CDN (
https://cdn.jsdelivr.net/npm/chart.js@4.4.0/dist/chart.umd.min.js). This is a standard and expected practice for web-based visualizations. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest user-supplied data and labels to populate JavaScript objects within HTML templates.
- Ingestion points: User-provided chart data, labels, and configuration options.
- Boundary markers: The templates do not use specific delimiters or warnings to isolate user-supplied strings from the surrounding JavaScript code.
- Capability inventory: The skill utilizes file system write capabilities to create the visualization packages in the
docs/sims/directory. - Sanitization: There is no mention of sanitization or escaping for user data. Some templates, such as
template-bubble.html, useinnerHTMLto render user-supplied strings, which could lead to Cross-Site Scripting (XSS) if the data contains malicious payloads. - [DYNAMIC_EXECUTION]: Generates JavaScript code blocks within HTML files at runtime based on user input and pre-defined templates. This is the primary function of the skill.
Audit Metadata