alterlab-scientific-schematics
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The entry point script
scripts/generate_schematic.pyusessubprocess.run()to execute a secondary AI-handling script. The implementation is secure as it uses a list of arguments rather than a raw shell string, preventing command injection from the user-provided prompt. - [EXTERNAL_DOWNLOADS]: The skill performs network operations to
openrouter.aito access image generation and vision-based quality review models. These network calls are essential for the skill's stated purpose. The skill provides clear documentation and environment variables (OPENROUTER_API_KEY) for managing these external connections. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text descriptions to generate visuals. This creates an indirect prompt injection surface where a user could potentially supply instructions that attempt to steer the image generation or review models. However, the system's capabilities are limited to local file writing of images and logs, and the risk is mitigated by explicit scientific guidelines embedded in the internal system prompts.
Audit Metadata