Skills
skills/jarmen423/skills/d3-viz/Gen Agent Trust Hub

d3-viz

Warn

Audited by Gen Agent Trust Hub on Feb 16, 2026

Risk Level: MEDIUMPROMPT_INJECTION
Full Analysis
  • [Indirect Prompt Injection] (MEDIUM): Vulnerability to XSS via unsanitized data rendering. Ingestion points: The data prop in InteractiveChart (assets/interactive-template.jsx) which may contain untrusted external data from sources the agent reads. Boundary markers: Absent. Capability inventory: The skill uses the D3.js .html() method to render tooltips. Sanitization: Absent; properties such as d.label are interpolated directly into the HTML string without escaping, allowing for arbitrary JavaScript execution (XSS) in the context where the chart is rendered. This could lead to session hijacking or data exfiltration from the user's browser environment.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Feb 16, 2026, 05:53 AM