infographics

Pass

Audited by Gen Agent Trust Hub on Jul 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The wrapper script generate_infographic.py uses the subprocess.run function to invoke the main logic script generate_infographic_ai.py. The command is constructed using a list and sys.executable, which is a secure method that avoids shell injection vulnerabilities.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with well-known AI service providers, specifically openrouter.ai and perplexity.ai, to generate images, review quality, and conduct web research. These network operations are intrinsic to the skill's stated functionality.
  • [SAFE]: Secret management follows industry standards by instructing users to provide API keys through environment variables or a local .env file, rather than hardcoding credentials.
  • [SAFE]: The skill implements a potential surface for indirect prompt injection when using the --research flag to ingest external web data. However, this is a primary feature for ensuring data accuracy, uses distinct text headers as boundary markers, and the risk is mitigated by the intended use case of generating static visual content.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 13, 2026, 10:21 AM