csv-data-visualizer
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided CSV files, which constitutes an ingestion point for untrusted data. While an attacker could embed malicious instructions in column headers or cell values, the skill's capabilities are limited to generating data visualizations and lacks dangerous execution or network functions.
- Ingestion points: The skill uses
pd.read_csv()to load data inscripts/visualize_csv.py,scripts/data_profile.py, andscripts/create_dashboard.py. - Boundary markers: The skill does not implement specific delimiters or 'ignore' instructions for the agent regarding the content of the CSV data.
- Capability inventory: Capabilities are restricted to writing visualization files (HTML, PNG, PDF, SVG) and printing statistical summaries. No
eval(),exec(), or subprocess calls to system shells are present. - Sanitization: Data is used directly from the CSV for plot labels and statistics without sanitization or validation of the text content.
Audit Metadata