yao-positioning-skill
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes a vendored version of the Apache ECharts visualization library in
assets/echarts.min.js. This is a well-known, trusted component used for rendering interactive charts within the offline HTML reports. - [COMMAND_EXECUTION]: The workflow relies on local Python scripts (
scripts/render-report.py,scripts/validate-intake.py, etc.) to validate input data and render report artifacts. These scripts use the Python standard library and do not exhibit dangerous command execution or subprocess spawning patterns. - [DATA_EXFILTRATION]: The skill includes a security feature in
scripts/sanitize-package.pythat explicitly scans for and redacts local absolute file paths (such as macOS/Users/or Windows\Users\patterns) from generated reports to prevent accidental data disclosure when sharing report bundles. - [SAFE]: The skill defines a formal permission policy in
security/permission_policy.json, scoping its file-write capabilities to the generation of specific report artifacts. It implements high-quality sanitization, such assafe_json_for_scriptand HTML escaping, to protect against potential cross-site scripting (XSS) when processing user-provided content.
Audit Metadata