data-visualization

Pass

Audited by Gen Agent Trust Hub on May 8, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the belt CLI to perform actions such as logging in and executing applications (e.g., belt app run). These are standard operations for the inference.sh platform.\n- [REMOTE_CODE_EXECUTION]: The skill provides Python code snippets to be executed via the infsh/python-executor tool. This is the primary mechanism for generating visualizations and operates within the vendor's environment.\n- [EXTERNAL_DOWNLOADS]: The documentation contains a link to installation instructions on the author's official GitHub repository (raw.githubusercontent.com/inference-sh/skills). This is a legitimate reference to vendor-provided documentation and does not involve automated script execution.\n- [PROMPT_INJECTION]: The skill templates present an indirect prompt injection surface where chart data (ingestion point) is interpolated into Python scripts without boundary markers or sanitization, which are then executed via belt app run (capability). This is a structural observation for this type of skill and not an indication of malicious intent.
Audit Metadata
Risk Level
SAFE
Analyzed
May 8, 2026, 10:25 PM