infographics
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The wrapper script
generate_infographic.pyuses thesubprocess.runfunction to invoke the main logic scriptgenerate_infographic_ai.py. The command is constructed using a list andsys.executable, which is a secure method that avoids shell injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The skill communicates with well-known AI service providers, specifically
openrouter.aiandperplexity.ai, to generate images, review quality, and conduct web research. These network operations are intrinsic to the skill's stated functionality. - [SAFE]: Secret management follows industry standards by instructing users to provide API keys through environment variables or a local
.envfile, rather than hardcoding credentials. - [SAFE]: The skill implements a potential surface for indirect prompt injection when using the
--researchflag to ingest external web data. However, this is a primary feature for ensuring data accuracy, uses distinct text headers as boundary markers, and the risk is mitigated by the intended use case of generating static visual content.
Audit Metadata