data-visualization
Pass
Audited by Gen Agent Trust Hub on May 8, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
beltCLI to perform actions such as logging in and executing applications (e.g.,belt app run). These are standard operations for the inference.sh platform.\n- [REMOTE_CODE_EXECUTION]: The skill provides Python code snippets to be executed via theinfsh/python-executortool. This is the primary mechanism for generating visualizations and operates within the vendor's environment.\n- [EXTERNAL_DOWNLOADS]: The documentation contains a link to installation instructions on the author's official GitHub repository (raw.githubusercontent.com/inference-sh/skills). This is a legitimate reference to vendor-provided documentation and does not involve automated script execution.\n- [PROMPT_INJECTION]: The skill templates present an indirect prompt injection surface where chart data (ingestion point) is interpolated into Python scripts without boundary markers or sanitization, which are then executed viabelt app run(capability). This is a structural observation for this type of skill and not an indication of malicious intent.
Audit Metadata