data-visualization
Warn
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install external dependencies and skills from the 'belt-sh' and 'inference-sh' organizations (e.g.,
npx skills add belt-sh/cli), which are not included in the trusted vendor list. - [EXTERNAL_DOWNLOADS]: The documentation references an external URL (
https://raw.githubusercontent.com/inference-sh/skills/refs/heads/main/cli-install.md) for obtaining installation instructions, which involves downloading content from a non-whitelisted source. - [COMMAND_EXECUTION]: The skill utilizes the
beltcommand to perform dynamic code execution. It passes raw Python scripts (usinginfsh/python-executor) and HTML strings (usinginfsh/html-to-image) as command-line arguments to be processed and executed by the tool.
Audit Metadata