infographic-generator-p5
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the p5.js library from
https://cdn.jsdelivr.net/npm/p5@1.11.10/lib/p5.js. The source is a well-known content delivery network, which is a common and expected practice for web-based visualizations. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from a
data.jsonfile to generate and populate visualizations, creating a potential surface for indirect prompt injection. - Ingestion points: Data is loaded from
data.jsonusing the p5.jsloadJSONfunction within thepreload()stage of the script. - Boundary markers: The skill templates do not provide explicit boundary markers or instructions to the agent to ignore potentially malicious instructions embedded in the data fields.
- Capability inventory: The skill possesses the capability to write files (HTML, JS, and JSON) to the local filesystem in the
/docs/sims/directory. - Sanitization: The provided JavaScript template implements a basic regular expression (
/<[^>]*>/g) to strip HTML tags before rendering text to the canvas, though this is primarily for visual rendering and does not sanitize the data at the agent's ingestion level. - [DYNAMIC_EXECUTION]: The skill instructs the agent to generate and save new JavaScript and HTML files based on provided templates. This involves the dynamic creation of executable code from known, benign templates to achieve the skill's primary purpose.
Audit Metadata