chart-visualization
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a local Node.js script (
scripts/generate.js) to handle chart generation. The agent is instructed to invoke this script with a JSON payload containing the data and chart specifications. - [EXTERNAL_DOWNLOADS]: The generation script transmits data to
antv-studio.alipay.comthrough HTTP POST requests to fetch the generated chart images. This domain belongs to a well-known service provider in the data visualization industry. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user data and processes it through an external API. While the script does not implement explicit boundary markers or sanitization, it enforces a JSON structure for all processed inputs, which significantly restricts the surface area for instruction injection during the visualization workflow.
Audit Metadata