infographic-generator-p5
Pass
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: LOW
Full Analysis
- EXTERNAL_DOWNLOADS (LOW): The skill loads the p5.js library from
https://cdn.jsdelivr.net/npm/p5@1.11.10/lib/p5.js. This is a trusted external source and follows standard practice for web-based visualizations. - DATA_EXFILTRATION (SAFE): No network exfiltration patterns were identified. The
loadJSONcall targets a localdata.jsonfile, and nofetchorXMLHttpRequestcalls to external domains are present. - COMMAND_EXECUTION (SAFE): There are no uses of
eval(),exec(), or subprocess spawning in the provided JavaScript file. - PROMPT_INJECTION (SAFE): No instructions targeting agent behavior override or safety bypass were found in the JSON metadata or code comments.
- INDIRECT_PROMPT_INJECTION (LOW): While the skill processes external data (JSON nodes/descriptions), the capability inventory is restricted to 2D canvas drawing (p5.js). There are no file-write, network-send, or code-execution capabilities available to an attacker through the processed data.
Audit Metadata