interactive-dashboard-builder
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the Chart.js library and a date-fns adapter from the jsDelivr CDN. These are widely recognized and standard libraries for browser-based data visualization and charting.
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits a Cross-Site Scripting (XSS) vulnerability surface due to its data-handling patterns.
- Ingestion points: The
DATAarray and thecolumnsdefinition withinSKILL.mdserve as ingestion points for data that may originate from untrusted sources. - Boundary markers: There are no boundary markers or instructions to treat data as distinct from executable code.
- Capability inventory: The
renderTablefunction utilizescontainer.innerHTMLto inject raw data values and column labels directly into the DOM. Furthermore, it constructsonclickattributes using string interpolation for sorting functionality. - Sanitization: The logic lacks any form of HTML escaping or sanitization, allowing malicious script tags or event handler payloads embedded in the data to execute when the dashboard is rendered or interacted with.
Audit Metadata