chart-visualization

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes a local Node.js script (scripts/generate.js) to handle chart generation. The agent is instructed to invoke this script with a JSON payload containing the data and chart specifications.
  • [EXTERNAL_DOWNLOADS]: The generation script transmits data to antv-studio.alipay.com through HTTP POST requests to fetch the generated chart images. This domain belongs to a well-known service provider in the data visualization industry.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user data and processes it through an external API. While the script does not implement explicit boundary markers or sanitization, it enforces a JSON structure for all processed inputs, which significantly restricts the surface area for instruction injection during the visualization workflow.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 03:45 PM
Security Audit — agent-trust-hub — chart-visualization