alterlab-scientific-schematics

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The entry point script scripts/generate_schematic.py uses subprocess.run() to execute a secondary AI-handling script. The implementation is secure as it uses a list of arguments rather than a raw shell string, preventing command injection from the user-provided prompt.
  • [EXTERNAL_DOWNLOADS]: The skill performs network operations to openrouter.ai to access image generation and vision-based quality review models. These network calls are essential for the skill's stated purpose. The skill provides clear documentation and environment variables (OPENROUTER_API_KEY) for managing these external connections.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text descriptions to generate visuals. This creates an indirect prompt injection surface where a user could potentially supply instructions that attempt to steer the image generation or review models. However, the system's capabilities are limited to local file writing of images and logs, and the risk is mitigated by explicit scientific guidelines embedded in the internal system prompts.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 02:37 PM