chart-visualization
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided data to generate chart requests. This represents a potential surface for indirect prompt injection if the source data contains instructions disguised as data. However, this is inherent to the primary function of a data visualization skill.
- Ingestion points: User data provided to the agent is processed in SKILL.md.
- Boundary markers: Absent.
- Capability inventory: Uses curl to communicate with an external API (antv-studio.alipay.com).
- Sanitization: Not explicitly described in instructions; relies on API-side processing of the JSON payload.
- [SAFE]: The skill uses curl to send data to https://antv-studio.alipay.com/api/gpt-vis. This domain is an official endpoint associated with the AntV project and the vendor antvis, representing normal functionality.
Audit Metadata