echarts
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions and examples reference standard library installations via npm (echarts, echarts-for-react, vue-echarts). The vanilla JS example utilizes a well-known CDN (jsdelivr.net) with a pinned version and Subresource Integrity (SRI) hash, which is an industry-standard security practice for verifying third-party scripts.
- [INDIRECT_PROMPT_INJECTION]: The documentation explicitly identifies a potential cross-site scripting (XSS) vulnerability surface where tooltip.formatter output is injected as HTML. It provides actionable remediation guidance, instructing developers to escape untrusted data or use richText mode to prevent malicious payload execution from external data sources.
- [COMMAND_EXECUTION]: The skill lists standard package manager commands (e.g., npm install) for the intended purpose of library setup. These are typical for developer-focused skills and do not involve suspicious or unauthorized system changes.
Audit Metadata