scientific-schematics

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill contains examples that pass API keys directly (api_key="your_openrouter_key" in code and --api-key "sk-or-v1-..." on the command line), which instructs embedding secret values verbatim into code/commands and creates an exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill makes runtime API calls to OpenRouter at https://openrouter.ai/api/v1 (set as self.base_url in scripts/generate_schematic_ai.py) to both generate images and obtain Gemini review text which is then parsed and injected back to improve prompts, so remote content directly controls prompts during execution.