Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent for chart generation, but it needs Review because it ships outdated rendering dependencies with current security advisories.
Review before installing, especially on systems that process untrusted chart specs or publish SVG output. Prefer upgrading sharp and Vega-family dependencies first, and keep --spec, --csv-file, and --output paths controlled by trusted runtime code rather than free-form user text.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Read from stdin:
curl -s api.example.com/metrics | node scripts/chart.mjs --type line --dark --output metrics.png
echo '[{"x":"A","y":1},{"x":"B","y":2}]' | node scripts/chart.mjs --output out.png
The lockfile pins sharp 0.33.5, and the supplied advisories indicate inherited memory-safety issues in bundled native image libraries such as libvips/libheif. In a chart-generation skill that processes image/chart inputs and emits image files, malformed input could trigger crashes or potentially deeper native-library exploitation, making this a real dependency risk rather than a false positive.
The lockfile includes vega 5.33.1, and the cited advisory describes XSS through Vega expressions. This skill's purpose is to render charts from potentially user-supplied specifications/data, so if generated Vega specs or expressions are later rendered in HTML/SVG contexts or reused by downstream systems, attacker-controlled content could execute script or inject active content.
vega-functions 5.18.1 is flagged for XSS via the setdata function, which is relevant because charting workflows often transform untrusted data into visualization specs. In this skill context, that increases risk if users can influence Vega/Vega-Lite behavior directly or if outputs are consumed in browsers, dashboards, or SVG-capable renderers.
vega-expression 5.1.2 is directly implicated in the same expression-based XSS issue, and expression evaluation is a core part of Vega/Vega-Lite processing. For a skill that converts data into publication-quality charts, accepting attacker-influenced specs or expressions makes this especially relevant because the library may evaluate hostile expressions during rendering or produce dangerous output for downstream display.
The dependency range for vega can resolve to 5.33.1, which is flagged as vulnerable to expression-based XSS. In a chart-generation skill that may process user-supplied chart specs or data, a vulnerable Vega expression engine can increase the risk of script injection or unsafe expression evaluation in downstream rendered outputs or consuming environments.
The resolved sharp version is reported to include vulnerable native imaging dependencies such as libvips/libheif. In an image-generation skill that parses and renders image content, vulnerable codecs can expose the service to memory corruption, denial of service, or malicious file parsing attacks when handling crafted inputs.
The manifest description says to use the skill when 'visualizing data, creating graphs, plotting time series, showing distributions, or generating chart images,' which is a very broad natural-language trigger surface for a markdown/manifest file. It does not provide clear boundaries, explicit trigger phrases, or negative examples to distinguish when this skill should or should not be invoked.
The skill instructs automatic use of Israel time to decide dark mode without user opt-in, which can cause behavior based on an unrelated locale and leak assumptions about geography or operator preferences into outputs. In agent settings, hardcoded locale/timezone rules are risky because they create nondeterministic behavior and can conflict with user context, policy, or audit expectations.
The markdown repeatedly instructs users to run commands with --output chart.png, which creates or overwrites local files, but it does not include any warning about filesystem effects. For a markdown skill description, file-writing behavior that affects user data should be disclosed, even briefly, so users understand the command will generate files on disk.
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"name": "chart-image-scripts",
"type": "module",
"dependencies": {
"vega": "^5.30.0",
"vega-lite": "^5.21.0",
"sharp": "^0.33.0"
}
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"type": "module",
"dependencies": {
"vega": "^5.30.0",
"vega-lite": "^5.21.0",
"sharp": "^0.33.0"
}
}
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"dependencies": {
"vega": "^5.30.0",
"vega-lite": "^5.21.0",
"sharp": "^0.33.0"
}
}
No suspicious patterns detected.