nature-figure
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
generate_openrouter_schematic.pyscript communicates with the OpenRouter Images API to generate and download scientific schematic drafts. It also supports downloading reference images from user-provided URLs. - [COMMAND_EXECUTION]: The skill uses local Python scripts (
nature_figure_backend.py) to manage user preferences for the plotting backend and to execute image generation tasks via CLI. - [PROMPT_INJECTION]: The skill contains a vulnerability surface for indirect prompt injection as it processes untrusted user data for prompt construction.
- Ingestion points: User-provided article titles, abstracts, and panel maps are processed by the
generate_openrouter_schematic.pyscript. - Boundary markers: Input is interpolated into prompts for the OpenRouter API without mandatory delimiters or instruction isolation logic.
- Capability inventory: The skill utilizes network requests to external APIs and file system writes for saving images and persistent configuration settings.
- Sanitization: No explicit filtering or validation of user-provided strings is performed before interpolation into the prompt sent to the external image generation service.
Audit Metadata