nature-figure
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest external user data, such as manuscript titles and abstracts, which are then used to construct prompts for the OpenRouter Images API (
openai/gpt-image-2) to generate graphical abstracts or mechanism diagrams. - Ingestion points: Data enters the agent's context through parameters in
scripts/generate_openrouter_schematic.py(specifically--abstract,--abstract-file,--prompt, and--prompt-file) as well as user-provided data files for plotting. - Boundary markers: The prompt-building logic in the script utilizes header labels (e.g., "Article summary:", "Desired panel flow:") to delimit user input, but it lacks strict isolation or warnings for the model to ignore embedded instructions within the ingested text.
- Capability inventory: The skill possesses network capabilities (sending data to the OpenRouter API), file system access (reading data files and writing output SVG/PDF/PNG files), and the ability to execute complex Python and R scripts.
- Sanitization: No significant sanitization, validation, or escaping of the ingested text is performed before it is interpolated into the API payload, potentially allowing for prompt injection attacks hidden within manuscript data.
Audit Metadata