hypothesis-generation
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/generate_schematic.pyusessubprocess.run()to invoke a helper script for AI image generation. The command is constructed as a list and executed without a shell, which follows security best practices to prevent command injection. - [COMMAND_EXECUTION]: The skill provides instructions for the agent to use
xelatexandbibtexto compile scientific reports from LaTeX templates located in theassets/directory. This is consistent with the skill's primary function of generating professional scientific documentation. - [INDIRECT_PROMPT_INJECTION]: The workflow involves fetching external literature from PubMed and general web searches using
WebFetchandWebSearch. While this ingests untrusted data into the agent's context, the skill's design involves the agent synthesizing this data into structured hypotheses rather than directly executing instructions from it. - [SAFE]: The skill makes network requests to
openrouter.aito utilize Gemini 3.1 Pro models for image generation and quality review. OpenRouter is a well-known technology service, and the data sent (prompts for scientific diagrams) is relevant to the stated purpose of the skill.
Audit Metadata