d3-viz
Pass
Audited by Gen Agent Trust Hub on Feb 19, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection (LOW): The
InteractiveChartcomponent inassets/interactive-template.jsxis vulnerable to XSS/Indirect Prompt Injection by rendering data properties into the DOM using D3's.html()method. - Ingestion points: Data provided to the
InteractiveChartvia thedataprop inassets/interactive-template.jsx. - Boundary markers: Absent; there are no delimiters or instructions to ignore embedded scripts in the data.
- Capability inventory: The component uses
d3.select(tooltipRef.current).html(...)to modify the DOM at runtime. - Sanitization: Absent; the properties
d.labelandd.categoryare interpolated directly into the HTML string without escaping or validation.
Audit Metadata