data-visualization

Warn

Audited by Gen Agent Trust Hub on Aug 6, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install external dependencies and skills from the 'belt-sh' and 'inference-sh' organizations (e.g., npx skills add belt-sh/cli), which are not included in the trusted vendor list.
  • [EXTERNAL_DOWNLOADS]: The documentation references an external URL (https://raw.githubusercontent.com/inference-sh/skills/refs/heads/main/cli-install.md) for obtaining installation instructions, which involves downloading content from a non-whitelisted source.
  • [COMMAND_EXECUTION]: The skill utilizes the belt command to perform dynamic code execution. It passes raw Python scripts (using infsh/python-executor) and HTML strings (using infsh/html-to-image) as command-line arguments to be processed and executed by the tool.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 6, 2026, 05:03 AM
Security Audit — agent-trust-hub — data-visualization