interactive-dashboard-builder
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The HTML template provided in the skill fetches Chart.js and the chartjs-adapter-date-fns library from the jsDelivr CDN. These references include Subresource Integrity (SRI) hashes and target established, reputable libraries.
- [PROMPT_INJECTION]: The skill contains code patterns that are vulnerable to Indirect Prompt Injection through Cross-Site Scripting (XSS). This occurs because the dashboard templates do not sanitize data before rendering it in the browser.
- Ingestion points: The DATA variable and data rows processed by the renderTable function in the generated HTML dashboard (SKILL.md).
- Boundary markers: No boundary markers or instructions to sanitize input are included in the patterns.
- Capability inventory: The resulting dashboard executes JavaScript in the user's browser context, which could be exploited if malicious data is ingested.
- Sanitization: The renderTable function uses innerHTML and string concatenation to build the table structure, allowing any HTML tags or script blocks within the data to be executed by the browser.
Audit Metadata